Installation

What's the best way to upgrade my environment to 4.2?

Splunk Employee
Splunk Employee

I've got 2 search heads and 4 indexers. What is the recommended way of upgrading the different components? Should I upgrade the search heads first, then indexers, then forwarders last? Can I live a hybrid state (some 4.1 indexers and some 4.2 indexers)?

Labels (3)
Tags (1)
1 Solution

Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

View solution in original post

Splunk Employee
Splunk Employee

When i upgraded an environment of 2 search heads and 10 indexers i started with the search heads first, then the 10 indexers. (did not need to upgrade forwarders).
However, i believe the rule of thumb is, to never have forwarders be of a higher version then the indexers, and not having indexers be of a higher version then search heads.
Hence it flows logically to have SearchHeads -> Indexers -> Forwarders.

I believe it is possible to have search heads on 4.2 and indexers on 4.1, however doing it this way you will not be able to use the combined license pooling, and basically you will not be using the full capabilities/improvements of the 4.2 version.

Moreover, 4.2 is much faster then 4.1 in regards to indexing, and a huge amount of bugs have been fixed, hence even though a hybrid state is possible, it is not imo recomendable.

View solution in original post

Ultra Champion

@jmulcaster_splunk posted an order-of-operations diagram with links to relevant documentation to help with upgrade planning. Check it out and let us know if you find it helpful. What's the order of operations for upgrading Splunk Enterprise?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!