Splunk Rollback

[sanjubaba]

Is it possible to rollback changes if we face some issue upon Splunk enterprise version upgrade?

[isoutamo]

It depends what kind of environment you have and which kind of update you have done. Quite often the answer is no or use your backups to restore to the previous version. That also needs that you have stopped your input for update time, otherwise you lost those events when you do a restore from backups.

r. Ismo

[sanjubaba]

@isoutamo Thank you for your reply.

Can you provide any document link or community discussion link regarding this topic?

[isoutamo]

You could found couple of cases how this can do on single instance by just googling with “splunk rollback update” those expects that there haven’t been any changes to indexes e.g. change of compression method etc.
r. Ismo