- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- What is procedure to upgrade universal and heavy f...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello ,
We have around 13 heavy forwarders.How does the upgrade thing work , should we log into each instance and do the upgrade or is there any way to upgrade through the deployment server.The same way we have 500 + universal forwarders , what is the way to upgrade every U.F.
Thanks IN ADVANCE
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk does not have a native feature for performing automatic/distributed upgrades of the software. We use Ansible internally to upgrade Splunk, but some customers use Chef, Salt, or Puppet to do it. For Windows, some customers use SCCM.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@vrmandadi you should not use deployment server for performing Splunk upgrade. For the Heavy forwarders it will be just like any other Splunk Enterprise instance upgrade.
For Universal forwarders on Windows and Linux you can use deployment tool for Windows like SCCM or script for Linux.
This document will be helpful for you for upgrading UF remotely. Do check for pre-requisites and whether you really need an upgrade for UFs.
https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/UpgradetheWindowsuniversalforwarder
https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/Upgradethenixuniversalforwarder
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk does not have a native feature for performing automatic/distributed upgrades of the software. We use Ansible internally to upgrade Splunk, but some customers use Chef, Salt, or Puppet to do it. For Windows, some customers use SCCM.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Writing a script should be the most easy way to upgrade the forwarders. Splunk doesn't have an option to upgrade the forwarders automatically.
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
