Request for splunk upgrade shell script for Linux/Unix

[santosh_scb]

Hi Team, Currently I am working on a UF Auto installation script where the script has to automatically upgrade the UF package on all Linux boxes (that have v6.5.3) running to v7.3.4 using this script.

The script should work as below:

• Check for any existing Splunk UF version on the Linux box, if it has UF v6.5.3 is already running then, stop the UF agent, upgrade the Splunk UF package - v7.3.4 (Untar the splunkforwarder.tgz) package and then start the Splunk services.

• Post that it should connect to a DS (updating deploymentclient.conf) with DS and 8090 port details.

• If the Linux box doesn't have any Splunk UF package installed then, the script should freshly install the UF v7.3.4 package on that Linux server and then connect to DS

Wanted to check if you have any reference shell script for the above upgrade/installation. Please note I will just use that script for reference purpose only and I won't use it directly as I don't have much details on shell scripting syntax. Request your help on this.
regards, Santosh

[nickhills · Accepted solution]

Here are some bits I have borrowed from some of my scripts.

Just note that you would need to change the paths (and the regex manifest check) for splunk forwarder

SPLUNK_HOME=/opt/splunk 
deploymentserver=your.deployment.server
dsport=8089

manifest=$(ls $SPLUNK_HOME/*-manifest 2> /dev/null)     
if [ -z ${manifest+x}  ];then
        echo "Splunk not installed - installing"
                # your install process
                # whatever
                # $SPLUNK_HOME/bin/splunk start --accept-license
        elif [[ $manifest =~ splunk-7\.3\.4 ]]; then
                echo "7.3.4 Is Already Installed"
                # do nothing
        elif [[ $manifest =~ splunk-6\.5\.3 ]]; then
                echo "6.5.3 Is installed - upgrading"
                # your upgrade process
                # $SPLUNK_HOME/bin/splunk stop
                # whatever
                # $SPLUNK_HOME/bin/splunk start --accept-license
fi

# write a new deploymentclient.conf to system/local
echo "[deployment-client]" > $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo " " >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo "[target-broker:deploymentServer]" >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf
echo "targetUri = $deploymentserver:$dsport" >> $SPLUNK_HOME/etc/system/local/deploymentclient.conf

# restart Splunk to pickup deployment client changes.
$SPLUNK_HOME/bin/splunk restart

[santosh_scb]

Hi Nick, thanks for the above script and that works perfectly fine on Linux servers.
I have one more requirement wherein I need to write the same script in Windows Power shell. Could you share me the script if you have.
regards, Santosh

[nickhills]

Hi @santosh_scb Sadly, I'm not really a windows guy (any more)
I'd suggest posting a new question - like this one, but specifying that you are looking for a power shell solution.
Good luck!

[santosh_scb]

Hi Nick, thanks for the suggestion.

With regards to the Linux UF upgrade script that you had shared, it works fine for upgrade of UF package whereas it throws error if the UF package needs to be executed for the first time on the server. The error is as below:

root@uklvadsb0361[DEV][opt] # /tmp/test/uf_upgrade.sh
ls: cannot access /opt/splunkforwarder/*-manifest: No such file or directory

Done!

The script first looks for "manifest=$(ls $SPLUNK_HOME/*-manifest) " and when doesn't find /opt/splunkforwarder it throws the error and comes out instead of executing the next line of installation of rpm package. Kindly help me on this issue. regards, Santosh

[nickhills]

Sorry - oversight on my part:

replace this line so that it reads manifest=$(ls $SPLUNK_HOME/*-manifest 2> /dev/null)

I have updated my answer too.

[santosh_scb]

Hey nick really thanks for quick support but even with above changes, the script is not working and just comes out wihtout fresh UF install. if condition is not executed
"if [ -z ${manifest+x} ];then"

Please refer the output below:

root@uklvadsb0361[DEV][test] # ./uf_upgrade.sh
Done!
(This is the last line of the script shared below without executing the if condition)

[santosh_scb]

Sharing the actual script that I am using here:

SPLUNK_HOME=/opt/splunkforwarder
manifest=$(ls $SPLUNK_HOME/*-manifest 2> /dev/null)
if [ -z ${manifest+x} ];then
echo "Splunk UF not installed - installing the UF v7.3.4 agent"
rpm -ivh splunkforwarder-7.3.4-13e97039fb65-linux-2.6-x86_64.rpm
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt"
echo "Generating DeploymentClient file ..."
{
echo "[deployment-client]"
echo "clientName=$HOSTNAME-dev-unixuf" > "$SPLUNK_HOME/etc/system/local/deploymentclient.conf"
chown -R splunk:splunk
$SPLUNK_HOME/etc/system/local/deploymentclient.conf
}
echo Done!
echo "Creating test-apps-deploy directory"
{
mkdir -p $SPLUNK_HOME/etc/apps/test-apps-deploy/local
chown -R splunk:splunk $SPLUNK_HOME/etc/apps/test-apps-deploy
}
echo Done!
echo "Generating DeploymentClient file ..."
(
echo "[deployment-client]"
echo "clientName=$HOSTNAME-dev-unixuf"
echo "[target-broker:deploymentServer]"
echo "targetUri=DSIP:8090"
) > "$SPLUNK_HOME/etc/apps/test-apps-deploy/local/deploymentclient.conf"
chown -R splunk:splunk $SPLUNK_HOME/etc/apps/test-apps-deploy/local/deploymentclient.conf
echo "Restarting UF agent post installation"
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk restart "
echo Splunk UF restarted succesfully
elif [[ $manifest =~ splunkforwarder-7.3.4 ]]; then
echo "Splunk UF v7.3.4 Is Already Installed"
echo "Nothing to do!!"
elif [[ $manifest =~ splunkforwarder-6.5.3 ]]; then
echo "Already Splunk UF v6.5.3 installed, upgrading UF to Intermediatary Version 7.1.6"
rpm -U splunkforwarder-7.1.6-8f009a3f5353-linux-2.6-x86_64.rpm
echo "Upgraded to v7.1.6"
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt"
echo "Starting the UF"
echo "Please Wait...Splunk UF will be upgraded to Version 7.3.4"
rpm -U splunkforwarder-7.3.4-13e97039fb65-linux-2.6-x86_64.rpm
echo Splunk UF upgraded to v7.3.4 succesfully!
echo Splunk UF starting now
/bin/su - splunk -c "/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt"
echo Splunk UF started succesfully
fi
echo Done!

[santosh_scb]

Thanks for the script nick. regards, Santosh