Installation

Splunk upgrade from 7.x to 8.x

sahabhi606
Path Finder

Dear All,

We have splunk environment consisting of :

Search head cluster (v7.33)
Index cluster (v7.0)
Deployment Server (v7.0)
Heavy Forwarders (v7.0 and v 6.6)
Deployer (v7.0)

We are planning to upgrade the environment to latest version. What should be the approach for the upgrade and what should be the sequence of upgrade. Also how can I check whether all of my installed apps are compatible with Splunk 8.x

Thanks.

Regards,
Abhi

Labels (4)
1 Solution

p_gurav
Champion

Hi sahabhi606,

In terms of steps:
1. Test your apps and make sure they are compatible with 8.0 (you need to go to Splunk base and check if they are compatible)
2. Upgrade Deployment Server (disable it first, then upgrade, do not restart it yet)
3. Upgrade Search Heads
4. Upgrade Indexers (once completed you can now restart your deployment server)
5. Upgrade Forwarders

While upgrading the indexer cluster follows steps mentioned in:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Upgradeacluster

While upgrading the search cluster follows steps mentioned in:
https://docs.splunk.com/Documentation/Splunk/8.0.1/DistSearch/UpgradeaSHC

For more info:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/UpgradeyourdistributedSplunkEnterpri...

View solution in original post

p_gurav
Champion

Hi sahabhi606,

In terms of steps:
1. Test your apps and make sure they are compatible with 8.0 (you need to go to Splunk base and check if they are compatible)
2. Upgrade Deployment Server (disable it first, then upgrade, do not restart it yet)
3. Upgrade Search Heads
4. Upgrade Indexers (once completed you can now restart your deployment server)
5. Upgrade Forwarders

While upgrading the indexer cluster follows steps mentioned in:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Upgradeacluster

While upgrading the search cluster follows steps mentioned in:
https://docs.splunk.com/Documentation/Splunk/8.0.1/DistSearch/UpgradeaSHC

For more info:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/UpgradeyourdistributedSplunkEnterpri...

View solution in original post

eddy_liang
Path Finder

For step 1, would looking at the app's compatibility to the upgraded version be sufficient?

0 Karma

RDumbeck
Engager

We have the same basic layout minus the heavy forwarders and all at v7.2.1  we want to go to latest as well but I need to have an idea of how long these steps will take and if there is any data modification for the new version of Splunk Enterprise.  Can you give me an idea?

1 cluster master server
1deployment master server
1deploy server  

1 multisite cluster of 3 indexers in site 1 and 2 indexers in site 2. so a total of 5 indexers.
2 search heads  in a cluster behind a load balancer

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!