Installation

Upgrading to Splunk 5.0 queries -

Contributor

I need to Upgrade my Splunk version 4.3.x to 5.

Queries :
If i STOP the Splunkd service , what will be the state of Hot bucket?
Where the newly received logs from forwarders go (or) temporarily queued for Splunkd to Up?
Can i STOP the Splunk service and take the hot bucket backup and restore in my new instance ?

Kindly please help.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Some of this does not make sense. Are you planning an in-place upgrade, or an upgrade as part of a migration to another machine? An upgrade in conjunction with a migration is a more complex operation, and if you have enterprise support I would recommend opening a case to discuss the steps and get their recommendations for the smoothest upgrade experience.

If you stop splunkd on your indexer, then ALL buckets - hot, warm, or cold - will be quiesed and closed. There will be no active updates to any of them, and you can take a full offline backup.

While Splunkd is down, forwarders will not be able to communicate with the indexer. Depending on how you have your forwarders configured and the types of inputs you are processing, some data will be queued. How much and for how long is a function of your configuration. Once you exceed what can be queued, it is possible for some to be lost. Larger queues, persistent queues, or indexer acknowledgement will affect how much data can be held at the forwarder and for how long.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Some of this does not make sense. Are you planning an in-place upgrade, or an upgrade as part of a migration to another machine? An upgrade in conjunction with a migration is a more complex operation, and if you have enterprise support I would recommend opening a case to discuss the steps and get their recommendations for the smoothest upgrade experience.

If you stop splunkd on your indexer, then ALL buckets - hot, warm, or cold - will be quiesed and closed. There will be no active updates to any of them, and you can take a full offline backup.

While Splunkd is down, forwarders will not be able to communicate with the indexer. Depending on how you have your forwarders configured and the types of inputs you are processing, some data will be queued. How much and for how long is a function of your configuration. Once you exceed what can be queued, it is possible for some to be lost. Larger queues, persistent queues, or indexer acknowledgement will affect how much data can be held at the forwarder and for how long.

View solution in original post

0 Karma