Splunk upgrade 6.5.2 to 7.3.4

[christianubeda]

Hi team!

If I want to update 6.5.2 to 7.3.4 can I do it directly? Or I have to do an extra step?

Exists a path route?

I have 1 Cluster + Deployer | 2 indexers | 3 search head | 1 HF

Thank you!

[gaurav_maniar]

Hi @christianubeda ,

Answer given by @gcusello is absolutely correct. I would like to add something to it.

If there is no specific reason or feature that you are looking in 7.3.4 than you can directly upgrade from 6.5.2 to 7.2.9.1.
In this case you don't have to any other version as intermediate step.

In the docs, version 7.2.9.1 is not mentioned, but you can download it from Older Versions.
Splunk 7.2.9.1 is just an minor upgrade to 7.2.9 with date & time format fix for 2020.

You can check the below links for reference,
https://docs.splunk.com/Documentation/Splunk/7.2.9/Installation/AboutupgradingREADTHISFIRST#Upgrade_...
https://docs.splunk.com/Documentation/Splunk/7.2.9/Indexer/Upgradeacluster

accept & up-vote the answer if it helped.
happy splunking........!!!

[gcusello · Accepted solution]

Hi @christianubeda,
Upgrades to Splunk Enterprise and Universal Forwarders version 7.3 require the existing installation to be version 6.6.x or higher. If the existing installation is version 6.5.x or lower, then you must upgrade to version 6.6.x as an intermediate step.

Here you can find all the infos you need https://docs.splunk.com/Documentation/Splunk/7.3.4/Installation/AboutupgradingREADTHISFIRST

Follow specific instructions to upgrade clusters
http://docs.splunk.com/Documentation/Splunk/7.3.4/Indexer/Upgradeacluster
http://docs.splunk.com/Documentation/Splunk/7.3.4/DistSearch/UpgradeaSHC

Anyway, the steps of the roles are the following:

• Master Node
• Deployer
• Search Heads
• Indexers
• Heavy Forwarders
• Universal Forwarders

Ciao.
Giuseppe