Getting Data In

splunk forwarder up-gradation using tar file on custom path

btshivanand
Path Finder

Hi All,

 

We are planning to upgrade splunk forwarders with ansible. We observed that our forwarders are running on custom path and we cannot run splunk as root user .we were checking tar options but i am not understanding how we extract the tar file on custom path.

can any one help with this?

 

Regards,Shivanand

Labels (1)
0 Karma

Vardhan
Contributor

Hi @btshivanand ,

To resolve the issue first move your existing custom package from splunkforwarder_xxx to splunkforwarder

then unzip the new version on the existing folder. Once it is upgraded move your new version folder name to old name.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Yes, correct. Your configuration files should be sitting on local folders. Since installation package has no local config it will not affect.

In any case it is better for you to test the procedure on a few test systems, after that put inside ansible.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

btshivanand
Path Finder

Thanks a lot.. thats the plan we will test in one of the environment before putting into the ansible. 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @btshivanand,

Now it is more clear.

So, you can extract tar to /tmp folder, then move it to opt/product/Splunk/splunkforwarder_xx path.

Splunk will make the upgrade when you restart the service.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

btshivanand
Path Finder

Thanks.. just need some mor clarification.

if i extract under /tmp splunkforwarder dir will create. i need to move this directory to /opt/product/Splunk/splunkforwarder_xx.

cp -r splunkforwarder /opt/product/Splunk/splunkforwarder_xx

can you confirm my understanding correct?

We dont miss any configuration which is configured in  input and output.conf 

Regards, Shivanand

 

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @btshivanand,

tar normally extract files to the splunk folder inside current directory.

You have two options;

Using -C argument with tar, below will install into /custom_path/splunk

tar xvzf splunk_package_name.tgz -C /custom_path

 Or you can run tar inside /custom_path

cd /custom_path
tar xvzf splunk_package_name.tgz
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

btshivanand
Path Finder

Thanks for the quick reply.

We are trying to upgrade existing version.i understand that we can extract the tar file on custom path but when we extract by default it creates folder call splunkforwarder.our custom path is

/opt/product/Splunk/splunkforwarder_xx
if i extract the file in /opt/product/Splunk/ a new directory will get create call splunkforwarder. it is not upgrading my custom path "splunkforwarder_xx"
 
i hope you understood my concern
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...