Hi All,
We are planning to upgrade splunk forwarders with ansible. We observed that our forwarders are running on custom path and we cannot run splunk as root user .we were checking tar options but i am not understanding how we extract the tar file on custom path.
can any one help with this?
Regards,Shivanand
Hi @btshivanand ,
To resolve the issue first move your existing custom package from splunkforwarder_xxx to splunkforwarder
then unzip the new version on the existing folder. Once it is upgraded move your new version folder name to old name.
Yes, correct. Your configuration files should be sitting on local folders. Since installation package has no local config it will not affect.
In any case it is better for you to test the procedure on a few test systems, after that put inside ansible.
Thanks a lot.. thats the plan we will test in one of the environment before putting into the ansible.
Hi @btshivanand,
Now it is more clear.
So, you can extract tar to /tmp folder, then move it to opt/product/Splunk/splunkforwarder_xx path.
Splunk will make the upgrade when you restart the service.
Thanks.. just need some mor clarification.
if i extract under /tmp splunkforwarder dir will create. i need to move this directory to /opt/product/Splunk/splunkforwarder_xx.
cp -r splunkforwarder /opt/product/Splunk/splunkforwarder_xx
can you confirm my understanding correct?
We dont miss any configuration which is configured in input and output.conf
Regards, Shivanand
Hi @btshivanand,
tar normally extract files to the splunk folder inside current directory.
You have two options;
Using -C argument with tar, below will install into /custom_path/splunk
tar xvzf splunk_package_name.tgz -C /custom_path
Or you can run tar inside /custom_path
cd /custom_path
tar xvzf splunk_package_name.tgz
Thanks for the quick reply.
We are trying to upgrade existing version.i understand that we can extract the tar file on custom path but when we extract by default it creates folder call splunkforwarder.our custom path is