Installation

Question about uninstall/reinstall of UF

jeffbat
Path Finder

This is on a Windows Server.

If we do an uninstall of the UF on the server and then reinstall a newer UF version on the server, when it gets its apps pushed back down to it from the deployment server; will it reread all of the logs that it might have already processed before?

Things like the Windows Eventlogs System/Security/Application logs?

I am working with one of our teams that is building out a method of request for getting agents onto a new server and then pushing out the inputs it will collect.  One of the steps utilized from other agents (different tools) that this process would emulate is for when a new request to make a change to an existing server would be to uninstall an existing agent and then install the latest version we have in our build process.

I am worried that if this is done then it would go back and reread all of the log events in any logs that the server would have setup for reading.

I have currently had them not do this process for Splunk UF and am looking to have them just do a check on the currently installed Splunk version and only run an upgrade if needed (not uninstall/reinstall).

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
It depends on how the UF is uninstalled. If the fishbucket is deleted then the new installation will not know where the old UF left off and will re-read data.
I prefer to install new versions on top of the old version.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
It depends on how the UF is uninstalled. If the fishbucket is deleted then the new installation will not know where the old UF left off and will re-read data.
I prefer to install new versions on top of the old version.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

jeffbat
Path Finder

Thanks.

That was what I was thinking.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!