Installation

What's the best way to upgrade my environment to 4.2?

matt
Splunk Employee
Splunk Employee

I've got 2 search heads and 4 indexers. What is the recommended way of upgrading the different components? Should I upgrade the search heads first, then indexers, then forwarders last? Can I live a hybrid state (some 4.1 indexers and some 4.2 indexers)?

Labels (3)
Tags (1)
1 Solution

Genti
Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

View solution in original post

Genti
Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

View solution in original post

sloshburch
Ultra Champion

@jmulcaster_splunk posted an order-of-operations diagram with links to relevant documentation to help with upgrade planning. Check it out and let us know if you find it helpful. What's the order of operations for upgrading Splunk Enterprise?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!