Update out of order

[vaylor]

Our Splunk environment is deployed over 5 servers: 1 cluster master, 1 deployment server, 2 indexers, and 1 KV store / search head. We are also using an automated patch management system that managed to push the update to 8.0 to 2 of these servers: the deployment server and the search head. This means that our cluster master and our indexers are still on 7.3.2.

What's the best way to get everything to 8.0 without causing any damage?

[richgalloway · Accepted solution]

The steps for upgrading an indexer cluster are documented at https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Upgradeacluster

[richgalloway]

IMO, 8.0 is not a patch. It's a major version change that should have been tested in dev/QA before it was deployed to production. Your automated patch system is broken.

Why do you have a deployer if you don't have a search head cluster?