Hi,
We are trying to upgrade Splunk enterprise from 7.3.1 to 8.1.5 . What will be the first activity like
1. Which major files we need to take backup?
2.We need to upgrade the less impacted item first?
3. Search head, monitoring console, indexers, deployment server what need to be updated first
4. Can we stop all indexers at a time during upgradation that cause any impact?
5. How about the forwarders upgradation?
Hi @Mukunda7
1. Which major files we need to take backup?
I would suggest to take backup of splunk etc dirctory
https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/HowtoupgradeSplunk#Phase_1:_Identify...
2.We need to upgrade the less impacted item first?
No, we need to upgarde the compnenets as per hirearchy
3. Search head, monitoring console, indexers, deployment server what need to be updated first
please upgrade in following order(which I folllowed when we upraded the infra)
1.Clustmaster
2.License Master
3.Search Head
4.Indexers (enable cluster master in maintenance )
5. Deployment server
6. forwarders
4. Can we stop all indexers at a time during upgradation that cause any impact??
In point of View no need to stop all the indexers same time, you can stop indexers one by one
enable clustermaster in maintenance mode
stop the indexer1 first and upgarde it and start the indexer
for deatrlied steps for indexer upgrade please refer to
https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Upgradeacluster#Site-by-site_upgrade_for_...
5. How about the forwarders upgradation?
please upgrade the forwader at last once all higer componets are upgraded. please upgrade the forwaders few at a time, that hleps to continuous data to sent to splunk by other forwarders
also please go throuth the following docs for upgrade related info
https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/AboutupgradingREADTHISFIRST
https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/HowtoupgradeSplunk
Hi @Mukunda7
1. Which major files we need to take backup?
I would suggest to take backup of splunk etc dirctory
https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/HowtoupgradeSplunk#Phase_1:_Identify...
2.We need to upgrade the less impacted item first?
No, we need to upgarde the compnenets as per hirearchy
3. Search head, monitoring console, indexers, deployment server what need to be updated first
please upgrade in following order(which I folllowed when we upraded the infra)
1.Clustmaster
2.License Master
3.Search Head
4.Indexers (enable cluster master in maintenance )
5. Deployment server
6. forwarders
4. Can we stop all indexers at a time during upgradation that cause any impact??
In point of View no need to stop all the indexers same time, you can stop indexers one by one
enable clustermaster in maintenance mode
stop the indexer1 first and upgarde it and start the indexer
for deatrlied steps for indexer upgrade please refer to
https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Upgradeacluster#Site-by-site_upgrade_for_...
5. How about the forwarders upgradation?
please upgrade the forwader at last once all higer componets are upgraded. please upgrade the forwaders few at a time, that hleps to continuous data to sent to splunk by other forwarders
also please go throuth the following docs for upgrade related info
https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/AboutupgradingREADTHISFIRST
https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/HowtoupgradeSplunk
Hi @Mukunda7
If your issue is resolved please accept the answer.
I will also request you to upvote the answers and comments here that you found useful
Hi @Mukunda7
There is no definitive guide other than splunk docs, you can start with following links and dive through it based on your existing setup.
https://docs.splunk.com/images/d/d3/Splunk_upgrade_order_of_ops.pdf
https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/HowtoupgradeSplunk
--
An upvote would be appreciated if this reply helps!