How to upgrade from Splunk 4.2.2 to latest version and can I keep indexed data?

New Member

Splunk current version is 4.2.2.
We want to upgrade to the latest version.

1. After version is up, can I keep old indexed data? it means old data is not lost?
2. Is there a detailed manual for upgrade on the Splunk site or etc?

Labels (1)
Tags (1)
0 Karma


Hi 05500,

Do backup's before upgrading! This will save you headaches.....
Next read the docs and if possible do a dry run on some dev/test server.

You should not loose any data because Splunk will not overwrite any existing indexes, but still remember to do backup's ....

Good luck ...

cheers, MuS


Hi -

Upgrading directly to version 6.2 from version 4.3 and earlier is not officially supported.

If you run version 4.3, upgrade to version 6.0 first before attempting an upgrade to 6.2.
If you run version 4.2, upgrade to version 5.0 first before attempting an upgrade to 6.2.
If you run a version earlier than 4.2, upgrade to version 4.3 first, then upgrade to version 6.0 before attempting an upgrade to 6.2. Read "About upgrading to 4.3 READ THIS FIRST" for specific details on how to upgrade to version 4.3. 

For more information , please refer to

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!