Last night I upgraded our Splunk "cluster" from 4.2.3 to 4.3.4. We have two pooled search heads. As the upgrade doc says, take the search heads out of the pool before you upgrade. After upgrading them all, put them back in the pool.
Search heads are up. Splunk sure appears to be working normally. But the icons on the Splunk > Manager page are all generic gear icons. My indexers show the new ones. I have two questions.
For example, the web page source generated from the search head says:
[a class="spl-manager-icon-default" href="/en-US/manager/system/licensing"]Licensing[/a]
The indexer says:
[a class="spl-manager-icon-licensing" href="/en-US/manager/system/licensing"]Licensing[/a]
(I've changed the angle brackets <> to square brackets [] so the HTML doesn't render.)
I flubbed this step in The Distributed Deployment Manual, Upgrade your distributed environment
After you upgrade the search head, place the confirmed working apps into
the $SPLUNK_HOME/etc/apps directory of the search head.
$SPLUNK_HOME is the pool area. Thanks to support for walking me through this.
(for those that want to see the link)
http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Upgradeyourdistributedenvironment
I flubbed this step in The Distributed Deployment Manual, Upgrade your distributed environment
After you upgrade the search head, place the confirmed working apps into
the $SPLUNK_HOME/etc/apps directory of the search head.
$SPLUNK_HOME is the pool area. Thanks to support for walking me through this.
(for those that want to see the link)
http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Upgradeyourdistributedenvironment
Another thing that we noticed was that the window for edit code has only three lines, and no color.