Enterprise Security: Upgrading from 4.1.x to 4.7.x version on SHC

[koshyk]

I was looking into upgrade of ES from 4.1.x version to 4.7.x version. (alongside Splunk).
I can see ES changed dramatically from 4.6.x version due to removal of correlationsearches.conf and needs migration using confcheck_es_correlationmigration.py

The documentation is very thin when it comes to SH cluster as it doesn't address how to do migration on SH members

1. If you do upgrade on Staging Server, and copy to Deployer, how does the upgrade happen in SH members & captain. How can the migration script be run in the SH members & captain?
2. Is it possible to completely remove Enterprise Security and install new ES rather than migrating? Any documentation to do this by saving the kvstore?

[smoir_splunk · Accepted solution]

If you manage your configurations on the deployer, then the migration script will make the changes necessary when you perform the upgrade on the staging server. There isn't any documentation about how to completely uninstall Splunk Enterprise Security, that might be something you would want professional services assistance with.

[koshyk]

I agree the script will perform upgrade on staging server. But how about the SH members? How the upgrade will be done on the SH members and captain? Or the deployer will ensure all the ES apps and custom apps with those stanza's will be wiped out of the SH members & captain?

[smoir_splunk]

the latter happens when you deploy out the upgraded configurations -- you copy the upgrade state from the staging server to the production deployer (per the docs: http://docs.splunk.com/Documentation/ES/5.0.0/Install/Upgradetonewerversion#Upgrade_Enterprise_Secur...) and then you deploy that out.

[koshyk]

Thank you. So the files in the SH members will be wiped out by the contents of Deployer with the latest conf?
(will accept the answer).

[smoir_splunk]

Correct! SHC is strange, so I totally understand wanting to follow up to make sure this will work the way you expect/hope. http://docs.splunk.com/Documentation/Splunk/7.1.0/DistSearch/PropagateSHCconfigurationchanges contains more details about how precisely the deployer works.

[koshyk]

thanks again mate. Accepted and voted up