Installation

Upgrading Splunk version from 6.0.1 to 6.6.1 then 7.2.1

marisstella
Explorer

Hello everyone!!
We are currently running at 6.0.1 of Splunk version and using SearchHead Pooling mechanism..
We want to upgrade to 7.2.1v.
So first we planned to upgrade to 6.6.1 then 7.2.1v...
So can I get any inputs on this upgradation? (Like is that okay or anything)

Which component should be upgraded first?? And what is the sequence?
We are currently using 16Gb ram and ordered 32Gb RAM for SH, Indexer, so is that sufficient??
Is there any separate process for SH, INDEXER POOLING??

0 Karma

vnravikumar
Champion
0 Karma

DenM
Explorer

Hello,

Yes i think it's and good idea to upgrade asap, you could directly upgrade to 7.3. Before doing the upgrade backup all you apps (or deployement server) and the critical conf files (/etc/system of all your splunk instances).

Prepare carefully the upgrade, check the compability matrix/release notes of the critical apps used in your infra and check if it's supported or if you need an upgrade too. Upgrading Splunk it's not the biggest work i think your case, upgrading all your apps need a good preparation. My advice, Create a document with all your apps/version, servers, and prepare your upgrade.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Capacity/Referencehardware

This documents will help you too: (read carefully the first one)
https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/AboutupgradingREADTHISFIRST

https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/UpgradeonUNIX

0 Karma

chinmoya
Communicator

I don't think you need to upgrade first to 6.6.1 and then to 7.2.1.
You can directly upgrade to 7.2.1
The component sequence wouldn't matter much.

Also, from your information, it's unclear if you have a clustered or distributed system. Or are using license master and/or cluster master.
But if you are, I suggest first upgrade your license master and/or cluster master and then other components.

One piece of advice. Splunk has done quite a few changes in 7.2.X version. Make sure your dashboards and reports are compatible with the version before upgrade.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...