All Apps and Add-ons

How to upgrade Splunk add-on for Windows is version 4.8.2 to 8.8.0

pp_spl
Splunk Employee
Splunk Employee

The latest Splunk add-on for Windows is version 8.8.0 https://splunkbase.splunk.com/app/742

For customers who are still on version 4.8.2 and they need to upgrade to version 8.8.0. The splunk documentation says to upgrade to version 5.0.1 first then upgrade to 6 then going from 6 to anything greater.

Since the download of the Splunk add-on for windows version 6.0 is not available from splunkbase:

1. Where can the customer gets the Splunk add-on for Windows is version 6.0 (https://splunkbase.splunk.com/app/742)? 

2. Can the customer upgrade directly from version 5.0.1 to 8.8.0 without breaking anything?

Note: Assuming that they already follow the steps outlined in Upgrade the Splunk Add-on for Windows  when you are upgrading from a version of the Splunk Add-on for Windows that is earlier than 5.0.0

Labels (1)
Tags (1)
0 Karma
1 Solution

_JP
Contributor

Can you work with Support to get the older version?

Also, what type of Splunk instance are you doing this on?  Is it a UF, HF, Search Head, Indexer, etc?  I think that might help you approach this.  Based on the docs  it sounds like losing some index configurations are part of the breaking changes.  For example, if this was an Indexer you're upgrading and relying on the indexes.conf in the Windows app to define that index, then you'll need to move those configurations into another indexes.conf within your deployment.  A similar situation exists for configurations included within authorize.conf for that older version.

 

BUT, if this is just a UF, then some of this might be a moot point because UF's don't care about the indexes.conf configurations.  You would probably have less concerns about doing this on a UF versus a Splunk instance that is part of the core infrastructure versus an edge agent.

 

View solution in original post

0 Karma

_JP
Contributor

Can you work with Support to get the older version?

Also, what type of Splunk instance are you doing this on?  Is it a UF, HF, Search Head, Indexer, etc?  I think that might help you approach this.  Based on the docs  it sounds like losing some index configurations are part of the breaking changes.  For example, if this was an Indexer you're upgrading and relying on the indexes.conf in the Windows app to define that index, then you'll need to move those configurations into another indexes.conf within your deployment.  A similar situation exists for configurations included within authorize.conf for that older version.

 

BUT, if this is just a UF, then some of this might be a moot point because UF's don't care about the indexes.conf configurations.  You would probably have less concerns about doing this on a UF versus a Splunk instance that is part of the core infrastructure versus an edge agent.

 

0 Karma

pp_spl
Splunk Employee
Splunk Employee

Thank you! This is really helpful.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...