Deployment Architecture

What is the recommended compatibility sequence of upgrading instances in my environment from Splunk 6.2.7 to 6.3.2?

rcreddy06
Path Finder

I have a deployment server, clustered Indexers, clustered search heads, heavy forwarders, & universal forwarders. All are running Splunk 6.2.7 and would like to upgrade to Splunk 6.3.2

I believe the compatibility sequence should be:
Cluster Master > Search Heads > Indexers > Heavy forwarders > Universal Forwarders and deployment server should be upgraded along with search heads or before cluster master.

I can't upgrade all servers on the same day. Please suggest compatibility of Splunk instances.

1 Solution

esix_splunk
Splunk Employee
Splunk Employee

You can break down your upgrade in to phases.

First should be your Cluster Master Node.

Second, should be Search Tier. Upgrade the instances individually, or if you are on a SHC, you need to upgrade the whole cluster.

Next would be the indexing tier:

Put your CM in to Maintenance Mode, upgrade it, restart, put back into maintenance mode. Upgrade all your indexers, once upgraded, take the CM out of Maintenance mode. This is a good check point to make sure your Cluster(s) rebalance and are reporting in correctly.

Your DS / HF / UF can be upgraded as time permits, they dont have specific version requirements. (Although check the DS, if you're using some legacy configuration settings, they may be deprecated.)

Make note, there are some version requirements between the Search and Indexing tiers to be cautious about..

Upgrading : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/HowtoupgradeSplunk
Upgrading Version Notes : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/Aboutupgradingto6.3READTHISFIRST
Version Compatibility : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

You can break down your upgrade in to phases.

First should be your Cluster Master Node.

Second, should be Search Tier. Upgrade the instances individually, or if you are on a SHC, you need to upgrade the whole cluster.

Next would be the indexing tier:

Put your CM in to Maintenance Mode, upgrade it, restart, put back into maintenance mode. Upgrade all your indexers, once upgraded, take the CM out of Maintenance mode. This is a good check point to make sure your Cluster(s) rebalance and are reporting in correctly.

Your DS / HF / UF can be upgraded as time permits, they dont have specific version requirements. (Although check the DS, if you're using some legacy configuration settings, they may be deprecated.)

Make note, there are some version requirements between the Search and Indexing tiers to be cautious about..

Upgrading : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/HowtoupgradeSplunk
Upgrading Version Notes : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/Aboutupgradingto6.3READTHISFIRST
Version Compatibility : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...

rcreddy06
Path Finder

From: http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...
Cluster master should be upgraded before search heads, then indexers.

Lucas_K
Motivator

^ this!

Very bad things happen if you do search heads first.

We had a situation when another admins search head got a day one upgrade without us knowing.

We suddenly had indexers start going offline due to incompatibilities. It was the first time we had search head causing indexer outages.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Thanks for the call out, updated.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...