Any good examples of run books for upgrading splunk 7.x to 8.x using Ansible?


Hello everyone,
This is kind of a general question but, are there any good examples of run books for upgrading Splunk 7.x to 8.x using Ansible out there? The goal is to upgrade the SHC, indexer cluster, deployer, cluster master, deployment server, HWF's and intermediate forwarders.

I am thinking about starting to use Ansible for Splunk upgrades even with minor versions (like 8.1 to 8.2) since Splunk version life cycle's are going to be tightened.

If anyone is already doing this can you let me know what i should look out for?

Thanks everyone!

Labels (3)


Without going into the specifics of Ansible, there are some other things you should be aware of when doing upgrades in an environment like that: Namely that the order of upgrades is important and you should ensure Ansible respects that (i.e. it doesn't attempt to do things in parallel).

You should first update the Licence Master, then the Cluster Master, then the Search Heads, then the Indexers.

You could create Ansible variables for LM_updated/CM_updated and assign them to be true if splunk --version matches the target version of an upgrade, so that phase two of an upgrade won't start until phase 1 has started.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...