Installation

What's the best way to upgrade my environment to 4.2?

matt
Splunk Employee
Splunk Employee

I've got 2 search heads and 4 indexers. What is the recommended way of upgrading the different components? Should I upgrade the search heads first, then indexers, then forwarders last? Can I live a hybrid state (some 4.1 indexers and some 4.2 indexers)?

Labels (3)
Tags (1)
1 Solution

Genti
Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

View solution in original post

Genti
Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

sloshburch
Splunk Employee
Splunk Employee

@jmulcaster_splunk posted an order-of-operations diagram with links to relevant documentation to help with upgrade planning. Check it out and let us know if you find it helpful. What's the order of operations for upgrading Splunk Enterprise?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...