I have to upgrade 2 SH and 4 indexer clusters from Splunk 6.3 to Splunk 6.6. SearchHeads are not pooled. I'll be upgrading indexer cluster sequentially, upgrading one indexer cluster at a time. I have 2 question
Because If I update 1 SH and 1 indexer cluster and their apps, then apps and add-ons might not work well on other indexer clusters and if I update all 4 indexers cluster and their apps first and then upgrade SH and its apps and add-ons then also apps might not work properly on both indexers and SHs till all apps and add-ons are upgraded on all indexers and SH.
read here for two options:
option 1 upgrade all tiers at once:
option 2 upgrade tiers seperately:
i recommend option 2
regarding the apps, upgrade those after you upgraded your environment
start with the search heads and then the indexers by pushing the new app version from cluster master
note: read upgrade instructions as some apps require slightly different process
note: always backup your splunk before upgrading and if not possible, make sure to run diag on all instances
hope it helps
Thanks! Any specific advantage in using option 2 over option 1 ?
i guess its a personal preference,
i like to have hands on process and also if something breaks, I know exactly where and when it was broken
which is helpful (for me) for a faster recovery.
Ok. So I have decided to follow below sequence for upgrading my Splunk environment:
1. Upgrade Cluster Master
2. Upgrade both SHs and their apps.
3. Upgrade Indexer and their apps via master.
I choose to upgrade apps before upgrading complete environment because lastest version of most of my apps are compatible with my current version of Splunk i.e Splunk 6.3 .
Now for rest of 3 clusters:
1. Upgrade Cluster master
2. Upgrade Indexer and their apps via master.
glad you have a process set.
if it answers your question, please mark it as answered.