All Apps and Add-ons

Upgrade DCN

simontam
Explorer

Is there any way to upgrade the data collection node? I am going to upgrade the Splunk app for VMware but cannot find any information about upgrading the dcn.

Should I just deploy a new one? But I am not sure what configuration has been done on it.

0 Karma

Masa
Splunk Employee
Splunk Employee

A good question! We used to have it in old versions.

Prerequisite
Find splunk_forwarder_for_vmware-<version>-<build_number>.zip in the downloaded VMware app package

Upgrade the data collection node

  1. Stop Splunk
  2. Install splunk_forwarder_for_vmware-<version>-<build_number>.zip
  3. Unzip this file (the data collection node components) from $SPLUNK_HOME
  4. Note: Make sure you unzip the package from $SPLUNK_HOME, not $SPLUNK_HOME/etc/apps
  5. Check that the data collection components SA-Utils, SA-Hydra, Splunk_TA_vmware, and Splunk_TA_esxilogs exist in $SPLUNK_HOME/etc/apps
  6. Delete the file $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local/hydra_job.conf
  7. Start Splunk

If the scheduler is not connecting to the new DCN for some reason,
1. please check versions of SA-Utils and SA-Hydra for both SH and DCN and make sure they are same.
2. Also, please try, delete the DCN from Configuration Collections and add it back.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...