topic Re: Synchronize Splunk 4.3.4 & Splunk 5 in Installation

Synchronize Splunk 4.3.4 & Splunk 5

chimbudp — Thu, 17 Jan 2013 06:36:29 GMT

Initially i started using Splunk 4.3.4 for my PRODUCTION machines. Now, i am using Splunk 5 in my test servers. How do i Synchronize both of these ?

Re: Synchronize Splunk 4.3.4 & Splunk 5

lguinn2 — Thu, 17 Jan 2013 06:53:33 GMT

What do you mean by synchronize?

Re: Synchronize Splunk 4.3.4 & Splunk 5

chimbudp — Thu, 17 Jan 2013 07:10:00 GMT

Sorry for the confusion.
i need to upgrade my Splunk to version 5 in PROD-
i need some suggestions on the important things to be taken care.
i am using Splunk for SQL & BizTalk Server monitoring. -

Re: Synchronize Splunk 4.3.4 & Splunk 5

yannK — Thu, 17 Jan 2013 17:26:28 GMT

Upgrade your 4.3.4 to 5.0.*, the procedure is straightforward.
Splunk admins do that every day without issues.

http://docs.splunk.com/Documentation/Splunk/latest/Installation/HowtoupgradeSplunk
in a nut shell :

stop splunk
backup your $SPLUNK_HOME/etc/ just in case
apply the upgrade

Simply untar the file over the splunk folder on linux (make sure to use the same user than the previous owner of the files, the folder is usually /opt/splunk)
or run the rpm if you used an rpm install before (specify the exact location if you didn't use the default /opt/splunk ), or install the msi on windows.