Deployment Architecture

If our Splunk 5.0.2 search head is also a deployment server for 100+ universal forwarders, what is the safest way to upgrade it to Splunk 6.2.3?

New Member

We are planning to upgrade our search head from 5.0.2 to 6.2.3. The search head is also the deployment server for 100+ universal forwarders. I read in many forums that the upgrade has broken their deployment server setting. Is there a safe way for this upgrade?

0 Karma

Contributor

It is safe if your serverclasses.conf is compatible, 😉 there we had an issue with more than one app in the same serverclass:

we had to change from:

[serverClass:ABC-ByMachineType]
whitelist.0 = *

[serverClass:ABC-ByMachineType:app:ABC-210-aix]
whitelist.0 = *
machineTypesFilter = aix-*

[serverClass:ABC-ByMachineType:app:ABC-230-linux]
whitelist.0 = *
machineTypesFilter = linux-*

To

[serverClass:ABC-ByMachineType-aix]
whitelist.0 = *
machineTypesFilter = aix-*

[serverClass:ABC-ByMachineType-aix:app:ABC-210-aix]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

[serverClass:ABC-ByMachineType-linux]
whitelist.0 = *
machineTypesFilter = linux-*

[serverClass:ABC-ByMachineType-linux:app:ABC-230-linux]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

but see also http://docs.splunk.com/Documentation/Splunk/6.2.4/Updating/Forwardermanagementcompatibility#List_of_...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!