I have a distributed environment with the following components:
- 1 Search head
- 1 license master
- 1 Deployment Server
- 1 Cluster Master
- 2 Peer indexers
I had a couple of questions relating to upgrading apps/add-ons:
Thanks,
Hi
here is excellent answer to update order of splunk servers in distributed environment https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Ent...
For apps and TAs you must read those installation and update instructions and follow those. In my personal preference is start from innermost and go towards outermost. Usually this means first IDX via CM if needed, then HF then UF and SH layer is the last one.
r. Ismo
Hi
here is excellent answer to update order of splunk servers in distributed environment https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Ent...
For apps and TAs you must read those installation and update instructions and follow those. In my personal preference is start from innermost and go towards outermost. Usually this means first IDX via CM if needed, then HF then UF and SH layer is the last one.
r. Ismo
Thanks for that info.
Further to my last ... doing some more investigation. The previous Apps/Add-ons actually were pushed out to my Indexers from my Cluster Master (i can see them under /etc/master-apps on my Cluster Master). So really my only question is whether there is a preferred order in which to upgrade apps across a distributed environment (e.g Search Head, then Indexer peers)
Hi @mike_k,
it isn't a best practice to directly install apps on the peers and I hint to take the opportunity from this upgrade to bring back your installation to the correct approach.
Then, there isn't any particular order in updating apps unless there are structural changes (e.g. changes in indexes or sourcetypes) that require you to update the indexers first.
Anyway I'd upgrade Indexers before the other systems.
Ciao.
Giuseppe