Deployment Architecture
Highlighted

If our Splunk 5.0.2 search head is also a deployment server for 100+ universal forwarders, what is the safest way to upgrade it to Splunk 6.2.3?

New Member

We are planning to upgrade our search head from 5.0.2 to 6.2.3. The search head is also the deployment server for 100+ universal forwarders. I read in many forums that the upgrade has broken their deployment server setting. Is there a safe way for this upgrade?

0 Karma
Highlighted

Re: If our Splunk 5.0.2 search head is also a deployment server for 100+ universal forwarders, what is the safest way to upgrade it to Splunk 6.2.3?

Contributor

It is safe if your serverclasses.conf is compatible, 😉 there we had an issue with more than one app in the same serverclass:

we had to change from:

[serverClass:ABC-ByMachineType]
whitelist.0 = *

[serverClass:ABC-ByMachineType:app:ABC-210-aix]
whitelist.0 = *
machineTypesFilter = aix-*

[serverClass:ABC-ByMachineType:app:ABC-230-linux]
whitelist.0 = *
machineTypesFilter = linux-*

To

[serverClass:ABC-ByMachineType-aix]
whitelist.0 = *
machineTypesFilter = aix-*

[serverClass:ABC-ByMachineType-aix:app:ABC-210-aix]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

[serverClass:ABC-ByMachineType-linux]
whitelist.0 = *
machineTypesFilter = linux-*

[serverClass:ABC-ByMachineType-linux:app:ABC-230-linux]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled

but see also http://docs.splunk.com/Documentation/Splunk/6.2.4/Updating/Forwardermanagementcompatibility#Listofincompatibilities

0 Karma