Why am I unable to successfully upgrade from Splunk 6.2 to 6.4 on Linux with my current attempts?

[skoelpin]

I'm trying to upgrade from 6.2 to 6.4 on a linux server and hitting some pain points. Can someone tell me what I'm doing wrong here?

Attempt 1
1) I backed up my Splunk_Home folder (Known as 'splunk') on my local drive
2) I renamed the splunk folder to 'splunkOLD' on that dev server
3) I downloaded this .rpm file splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm
4) I ran this command rpm -U splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm
5) Accepted the license agreement
6) Installed a fresh copy of Splunk which did not retain the user accounts and data, or my conf files.. The UI was available, but I only had access to the admin/changeme creds

Attempt 2
1) Splunk_Home folder is still backed up on my local drive
2) I rename that splunkOLD folder back to its original name splunk
3) I ran this command rpm -U splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm
4) It says...

warning: splunk-6.4.0-f2c836328108-linux-2.6-x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID xxxxxxxx: NOKEY
        package splunk-6.4.0-f2c836328108.x86_64 is already installed

[skoelpin · Accepted solution]

I was able to successfully upgrade.. To get around the error above, I had to replace it with the new installation running this command. I then started Splunk and it upgraded correctly

rpm -iv --replacepkgs 6.4.0xxxx.rpm

[rasensio]

I did the "rpm -iv ..." but after restart is still starting the older version of splunk. Anyone found another workaround ? my next try will be untar

[skoelpin]

Do you have a standalone indexer or clustered environment? Make sure to stop all Splunk services/daemons before upgrading. You can also check the version which is a text file titled 'version.txt'..

It's super easy to upgrade using the rpm.. You could also upgrade pretty easily with the targz file

[todd_miller]

Did you try just extracting the .tgz version over your existing installation?

[skoelpin]

Yes and I was unable to install it. The last install we did was the .rpm file so I'm assuming that's the correct file to grab

[somesoni2]

Did you remove/uninstall Splunk6.4 from Attempt1 before try Attempt2?

[skoelpin]

No, I'll try that now and report my results back

[skoelpin]

I went to uninstall that .rpm file and it says package splunk-6.4.0... is not installed

I then tried to update this rpm file and it says package splunk-6.4.0.. is already installed