How do I upgrade my Windows 32-bit splunk install to a 64-bit install?

[Lowell]

I'm looking to upgrade my splunk forwarder from a 32-bit Windows version to the 64-bit windows version. Can I simply install the 64-bit over-top of the 32-bit version?

Also, from what I've seen the 32 bit version gets installed to C:\Program Files (x86)\Splunk where as the 64-bit version is installed to C:\Program Files\Splunk. So the default install paths are different in this case.

Should I install to the default location (which is a "new" install), copy over my config settings, then copy the fisbucket index so that it remembers what has been indexed and what has not. I don't want my files to be re-indexed again.

Also, is there any advantage to moving to 64-bit for Splunk forwarder?

[Ledio_Ago · Accepted solution]

First moving to 64bit wouldn't help a forwarder much, at least that's the idea. The forwarder shouldn't be doing much to begin with, beside just moving data to an indexer.

If you do decided to upgrade, I would:

• back up your etc and var folders, and also your license file if this was a server.
• also using Windows service manager figure out what user is Splunk running as. You'll need to install the new Splunk with the same user so that the file ownership remains the same.
• uninstall the current splunk, it doesn't install in a different directory than the 64bit version.
• install new Splunk 64bit Splunk
• stop it, copy over etc and var folders
• restart it.