All Apps and Add-ons

Upgrading Lookup file editor 2.7.0 to 3.3.3 in SHC

splunkreal
Motivator

Hello,
is there any recommandation to upgrade 2.7.0 to 3.3.3 on Splunk 7.1.4 (clustered SH)?

Should we just delete "lookup_editor" in /etc/shcluster on deployer, extract new version then deploy it?

We currently have an issue with lookup files being owned by "nobody" user on 2.7.0 version ( issue link text )

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

splunkreal
Motivator

Solved, just needed to restart search heads, app update installed by deploying new untarred files from deployer.

* If this helps, please upvote or accept solution if it solved *

View solution in original post

0 Karma

splunkreal
Motivator

Solved, just needed to restart search heads, app update installed by deploying new untarred files from deployer.

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...