If our Splunk 5.0.2 search head is also a deployment server for 100+ universal forwarders, what is the safest way to upgrade it to Splunk 6.2.3?

[jayregu]

We are planning to upgrade our search head from 5.0.2 to 6.2.3. The search head is also the deployment server for 100+ universal forwarders. I read in many forums that the upgrade has broken their deployment server setting. Is there a safe way for this upgrade?

[FritzWittwer_ol]

It is safe if your serverclasses.conf is compatible, 😉 there we had an issue with more than one app in the same serverclass:

we had to change from:

[serverClass:ABC-ByMachineType]
whitelist.0 = *

[serverClass:ABC-ByMachineType:app:ABC-210-aix]
whitelist.0 = *
machineTypesFilter = aix-*

[serverClass:ABC-ByMachineType:app:ABC-230-linux]
whitelist.0 = *
machineTypesFilter = linux-*

To

[serverClass:ABC-ByMachineType-aix]
whitelist.0 = *
machineTypesFilter = aix-*

[serverClass:ABC-ByMachineType-aix:app:ABC-210-aix]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

[serverClass:ABC-ByMachineType-linux]
whitelist.0 = *
machineTypesFilter = linux-*

[serverClass:ABC-ByMachineType-linux:app:ABC-230-linux]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

but see also http://docs.splunk.com/Documentation/Splunk/6.2.4/Updating/Forwardermanagementcompatibility#List_of_...