Installation

What will happen if you Upgrade UF without stopping splunk service?

datamine
Loves-to-Learn

hi All,

Does anyone has any idea about the cons if we upgrade a UF on Linux/Windows machine without stopping the splunk service?

In documentation ut says first we need stop the splunk service and then install the new/higher version like from v7.0.5 to v7.3.1

Thanks,
Devon

Labels (4)
0 Karma

FrankVl
Ultra Champion

Upgrading involves replacing a bunch of files in the install directory. You can't do that if your splunk instance is still running.

Depending on the platform and install method, you'll either get errors from the installer, or get errors that files cannot be overwritten because they are in use.

Also for example on linux when you use the method to manually unpack a tgz archive, the first time splunk starts after the upgrade, some actions are performed.

All-in-all: just follow the instructions and stop the UF before upgrading.

0 Karma

datamine
Loves-to-Learn

hi @FrankVl

I have tried on Windows, Ubuntu and CentOS by running the installer without stopping the Splunk UF process and it seems the installer will stop the process and then proceeds with replacing the files and upgrade steps. I havent seen any errors post upgrading on the logs.

Thanks,
Devon

0 Karma

FrankVl
Ultra Champion

That could be. On windows I know that is indeed the case, on linux there are various installer options, while many people also just manually unpack and deploy the tgz archive. I guess that is why the docs choose the better safe than sorry option and recommend to stop splunk before installing, so there is no dependency on the particular installer being used.

Also, it is good to realize that even if the installer does it for you, the install does involve stopping and starting splunk.

0 Karma

anthonymelita
Contributor

The installer attempts to stop the service.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.