Getting Data In

Request for splunk upgrade shell script for Linux/Unix

santosh_scb
Path Finder

Hi Team, Currently I am working on a UF Auto installation script where the script has to automatically upgrade the UF package on all Linux boxes (that have v6.5.3) running to v7.3.4 using this script.

The script should work as below:

  • Check for any existing Splunk UF version on the Linux box, if it has UF v6.5.3 is already running then, stop the UF agent, upgrade the Splunk UF package - v7.3.4 (Untar the splunkforwarder.tgz) package and then start the Splunk services.
  • Post that it should connect to a DS (updating deploymentclient.conf) with DS and 8090 port details.

  • If the Linux box doesn't have any Splunk UF package installed then, the script should freshly install the UF v7.3.4 package on that Linux server and then connect to DS

Wanted to check if you have any reference shell script for the above upgrade/installation. Please note I will just use that script for reference purpose only and I won't use it directly as I don't have much details on shell scripting syntax. Request your help on this.
regards, Santosh

1 Solution

nickhills
Ultra Champion

Here are some bits I have borrowed from some of my scripts.

Just note that you would need to change the paths (and the regex manifest check) for splunk forwarder

SPLUNK_HOME=/opt/splunk 
deploymentserver=your.deployment.server
dsport=8089

manifest=$(ls $SPLUNK_HOME/*-manifest 2> /dev/null)     
if [ -z ${manifest+x}  ];then
        echo "Splunk not installed - installing"
                # your install process
                # whatever
                # $SPLUNK_HOME/bin/splunk start --accept-license
        elif [[ $manifest =~ splunk-7\.3\.4 ]]; then
                echo "7.3.4 Is Already Installed"
                # do nothing
        elif [[ $manifest =~ splunk-6\.5\.3 ]]; then
                echo "6.5.3 Is installed - upgrading"
                # your upgrade process
                # $SPLUNK_HOME/bin/splunk stop
                # whatever
                # $SPLUNK_HOME/bin/splunk start --accept-license
fi

# write a new deploymentclient.conf to system/local
echo "[deployment-client]" > $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo " " >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo "[target-broker:deploymentServer]" >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo "targetUri = $deploymentserver:$dsport" >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf

# restart Splunk to pickup deployment client changes.
$SPLUNK_HOME/bin/splunk restart
If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Here are some bits I have borrowed from some of my scripts.

Just note that you would need to change the paths (and the regex manifest check) for splunk forwarder

SPLUNK_HOME=/opt/splunk 
deploymentserver=your.deployment.server
dsport=8089

manifest=$(ls $SPLUNK_HOME/*-manifest 2> /dev/null)     
if [ -z ${manifest+x}  ];then
        echo "Splunk not installed - installing"
                # your install process
                # whatever
                # $SPLUNK_HOME/bin/splunk start --accept-license
        elif [[ $manifest =~ splunk-7\.3\.4 ]]; then
                echo "7.3.4 Is Already Installed"
                # do nothing
        elif [[ $manifest =~ splunk-6\.5\.3 ]]; then
                echo "6.5.3 Is installed - upgrading"
                # your upgrade process
                # $SPLUNK_HOME/bin/splunk stop
                # whatever
                # $SPLUNK_HOME/bin/splunk start --accept-license
fi

# write a new deploymentclient.conf to system/local
echo "[deployment-client]" > $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo " " >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo "[target-broker:deploymentServer]" >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo "targetUri = $deploymentserver:$dsport" >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf

# restart Splunk to pickup deployment client changes.
$SPLUNK_HOME/bin/splunk restart
If my comment helps, please give it a thumbs up!

santosh_scb
Path Finder

Hi Nick, thanks for the above script and that works perfectly fine on Linux servers.
I have one more requirement wherein I need to write the same script in Windows Power shell. Could you share me the script if you have.
regards, Santosh

0 Karma

nickhills
Ultra Champion

Hi @santosh_scb Sadly, I'm not really a windows guy (any more)
I'd suggest posting a new question - like this one, but specifying that you are looking for a power shell solution.
Good luck!

If my comment helps, please give it a thumbs up!
0 Karma

santosh_scb
Path Finder

Hi Nick, thanks for the suggestion.

With regards to the Linux UF upgrade script that you had shared, it works fine for upgrade of UF package whereas it throws error if the UF package needs to be executed for the first time on the server. The error is as below:

root@uklvadsb0361[DEV][opt] # /tmp/test/uf_upgrade.sh
ls: cannot access /opt/splunkforwarder/*-manifest: No such file or directory

Done!

The script first looks for "manifest=$(ls $SPLUNK_HOME/*-manifest) " and when doesn't find /opt/splunkforwarder it throws the error and comes out instead of executing the next line of installation of rpm package. Kindly help me on this issue. regards, Santosh

0 Karma

nickhills
Ultra Champion

Sorry - oversight on my part:

replace this line so that it reads manifest=$(ls $SPLUNK_HOME/*-manifest 2> /dev/null)

I have updated my answer too.

If my comment helps, please give it a thumbs up!

santosh_scb
Path Finder

Hey nick really thanks for quick support but even with above changes, the script is not working and just comes out wihtout fresh UF install. if condition is not executed
"if [ -z ${manifest+x} ];then"

Please refer the output below:

root@uklvadsb0361[DEV][test] # ./uf_upgrade.sh
Done!
(This is the last line of the script shared below without executing the if condition)

0 Karma

santosh_scb
Path Finder

Sharing the actual script that I am using here:

SPLUNK_HOME=/opt/splunkforwarder
manifest=$(ls $SPLUNK_HOME/*-manifest 2> /dev/null)
if [ -z ${manifest+x} ];then
echo "Splunk UF not installed - installing the UF v7.3.4 agent"
rpm -ivh splunkforwarder-7.3.4-13e97039fb65-linux-2.6-x86_64.rpm
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt"
echo "Generating DeploymentClient file ..."
{
echo "[deployment-client]"
echo "clientName=$HOSTNAME-dev-unixuf" > "$SPLUNK_HOME/etc/system/local/deploymentclient.conf"
chown -R splunk:splunk
$SPLUNK_HOME/etc/system/local/deploymentclient.conf
}
echo Done!
echo "Creating test-apps-deploy directory"
{
mkdir -p $SPLUNK_HOME/etc/apps/test-apps-deploy/local
chown -R splunk:splunk $SPLUNK_HOME/etc/apps/test-apps-deploy
}
echo Done!
echo "Generating DeploymentClient file ..."
(
echo "[deployment-client]"
echo "clientName=$HOSTNAME-dev-unixuf"
echo "[target-broker:deploymentServer]"
echo "targetUri=DSIP:8090"
) > "$SPLUNK_HOME/etc/apps/test-apps-deploy/local/deploymentclient.conf"
chown -R splunk:splunk $SPLUNK_HOME/etc/apps/test-apps-deploy/local/deploymentclient.conf
echo "Restarting UF agent post installation"
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk restart "
echo Splunk UF restarted succesfully
elif [[ $manifest =~ splunkforwarder-7.3.4 ]]; then
echo "Splunk UF v7.3.4 Is Already Installed"
echo "Nothing to do!!"
elif [[ $manifest =~ splunkforwarder-6.5.3 ]]; then
echo "Already Splunk UF v6.5.3 installed, upgrading UF to Intermediatary Version 7.1.6"
rpm -U splunkforwarder-7.1.6-8f009a3f5353-linux-2.6-x86_64.rpm
echo "Upgraded to v7.1.6"
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt"
echo "Starting the UF"
echo "Please Wait...Splunk UF will be upgraded to Version 7.3.4"
rpm -U splunkforwarder-7.3.4-13e97039fb65-linux-2.6-x86_64.rpm
echo Splunk UF upgraded to v7.3.4 succesfully!
echo Splunk UF starting now
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt"
echo Splunk UF started succesfully
fi
echo Done!

santosh_scb
Path Finder

Thanks for the script nick. regards, Santosh

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...