Getting Data In

Upgrading Universal Forwarder from 5.0.2 to 6.5.4

vincenteous
Communicator

Hello Splunk Experts,

Recently, I've been tasked to upgrade a distributed Splunk environment with the condition as follows:

  • Search Head & Indexer version: 6.1.3
  • Universal Forwarder version: 5.0.2

There are 2 things in which I need confirmation of:

  1. Is it possible to perform upgrade directly from 5.0.2 to 6.5.4 for UF?
  2. Could I upgrade UF first before upgrading SH and then IDX?

Thank you and please advise.

0 Karma

adonio
SplunkTrust
SplunkTrust

hello there,
question 1
per this doc:
http://docs.splunk.com/Documentation/Forwarder/6.6.2/Forwarder/Upgradethenixuniversalforwarder
which leads you to this doc:
http://docs.splunk.com/Documentation/Splunk/6.6.2/Installation/HowtoupgradeSplunk
upgrading from version 5.0 to 6.x is not supported.
it also says to upgrade to 6.3 first and then move on to desired version.
question 2
upgrade the Search Head first then the indexer and lastly the forwarders
hope it helps

vincenteous
Communicator

Hello adonio,

Thank you for the documentation. I read the doc and I found another link about upgrading there:

http://docs.splunk.com/Documentation/Splunk/6.6.2/Installation/Aboutupgradingto6.6READTHISFIRST

That doc also mentions about upgrade path, but it seems that you can directly upgrade UF from 5.x to 6.x (in my case to 6.5.4). Now I'm confused on what to follow. Is it possible that upgrading to 6.3 first only mandatory for Splunk Enterprise?

0 Karma

adonio
SplunkTrust
SplunkTrust

interesting,
i guess you can go either way as its not supported.
better try to go to 6.3 first
cheers

0 Karma

vincenteous
Communicator

All right. Thank you for your insight.
I guess I will try to request a development environment to test things out.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!