Installation

What's the best way to upgrade my environment to 4.2?

matt
Splunk Employee
Splunk Employee

I've got 2 search heads and 4 indexers. What is the recommended way of upgrading the different components? Should I upgrade the search heads first, then indexers, then forwarders last? Can I live a hybrid state (some 4.1 indexers and some 4.2 indexers)?

Labels (3)
Tags (1)
1 Solution

Genti
Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

View solution in original post

Genti
Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

sloshburch
Splunk Employee
Splunk Employee

@jmulcaster_splunk posted an order-of-operations diagram with links to relevant documentation to help with upgrade planning. Check it out and let us know if you find it helpful. What's the order of operations for upgrading Splunk Enterprise?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...