How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

[Suyalag]

Hi,

I have set up a deployment server with a test app directory under etc/deployment-app along with a default inputs.conf. It also has a local folder and an app.conf auto generated file. Then I have a default serverclass.conf under etc/system/local. I also have a deployment-client.conf file set up on the forwarders. The clients are connecting to the server fine and also saying that the clients are deployed, but it is not updating the forwarder from version 6.2 to 6.4. Am I missing a step that is preventing it from updating the forwarder?

Also, I have the rmp file in the etc/deployment-app/testapp folder.
Please let me know what I am doing wrong.

Thank you for your help.
Gary

[chrismewett]

There's now a splunk blog post on doing exactly this for linux forwarders (to match @mikehodges01 approach for windows, viz:
https://www.splunk.com/blog/2017/04/28/upgrading-linux-forwarders-using-the-deployment-server.html

[mikehodges01]

I'm doing exactly this. Write a script and refer to it in an inputs.conf.

I have an app folder "WinUpdate", then I have "default" and "bin". In \default is an inputs.conf that says [script://..\bin\installer.bat]. Under \bin I place the forwarder MSI and an install script that checks the currently installed version of Splunk against a copy of splunk.version I put in \bin as well. If they're different, the script executes and upgrades the UFs. Get a little creative! Splunk can do almost anything you need it to do. This method works perfectly for me.

[mhsears418]

awesome MikeH. You mention an install script that checks if versions are different. could you post that or get example to me?

[mikehodges01]

I used to get the output of splunk.exe version and put it in a file that I distributed with the app, then issue that same command in my script on the target machine and dump the output to a temp file, and then use Windows fc to compare the files. If they're different, run the upgrade. Now I'm upgrading to a Powershell script that uses a regex match to pull the version from etc\splunk.version on the target machine and the MSI I include in the app to see if they're the same.

[regex]$regex = "\d\.\d\.\d"

[mhsears418]

Mike, so is your hierarchy like this? C:\ProgramFiles\Splunk\etc\apps\WinUpdate\Default
C:\ProgramFiles\Splunk\etc\apps\WinUpdate\Default

Or C:\ProgramFiles\Splunk\etc\apps\WinUpdate\
C:\ProgramFiles\Splunk\etc\apps\Default
C:\ProgramFiles\Splunk\etc\apps\Bin

[cboillot]

@mikehodges01 could you share the Script?

[mhsears418]

ok very cool info...appreciate it.

[ppeterson]

I'd love to see the powershell script you have or a partial as i"ll be needing to do the same.

[esix_splunk · Accepted solution]

As somesoni2 points out, you cannot use the Deployment Server to upgrade an actual Splunk instance { Enterprise or UF. } The deployment server is only used for managing installled apps within the client, not the actual client.

With that in mind, you need to rely on automation or manual processes to upgrade the actual client.

On a side note, when you upgrade, your deployment server configuration will be preserved and not deleted, so you can do in place upgrades and not have to worry about the clients loosing the deployment server configurations.

[Michael]

ha! Great, I read this now. That was a large part of our decision to go with a deployment server architecture....

[somesoni2]

AFAIK, you can't upgrade Splunk version on deployment client using deployment server. You would have to use regular methods that you use in your Company to upgrade those (manually on each server, OR using some remote script execution method like upush OR puppet etc). http://docs.splunk.com/Documentation/Splunk/6.4.3/Updating/Configuredeploymentclients#Upgrade_a_depl...

[Suyalag]

not upgrading the splunk enterprise version just splunk forwarder from a splunk enterprise instance. Can i not do that either?

[chrismewett]

There have been developments over the last few months - check out the other comments on the thread.

[somesoni2]

Product version, whether it's a Splunk Enterprise OR Splunk Universal Forwarder, upgrade is not possible through Deployment server.