I was looking into upgrade of ES from 4.1.x version to 4.7.x version. (alongside Splunk).
I can see ES changed dramatically from 4.6.x version due to removal of correlationsearches.conf and needs migration using confcheckescorrelationmigration.py
The documentation is very thin when it comes to SH cluster as it doesn't address how to do migration on SH members
If you manage your configurations on the deployer, then the migration script will make the changes necessary when you perform the upgrade on the staging server. There isn't any documentation about how to completely uninstall Splunk Enterprise Security, that might be something you would want professional services assistance with.
I agree the script will perform upgrade on staging server. But how about the SH members? How the upgrade will be done on the SH members and captain? Or the deployer will ensure all the ES apps and custom apps with those stanza's will be wiped out of the SH members & captain?
the latter happens when you deploy out the upgraded configurations -- you copy the upgrade state from the staging server to the production deployer (per the docs: http://docs.splunk.com/Documentation/ES/5.0.0/Install/Upgradetonewerversion#Upgrade_Enterprise_Secur...) and then you deploy that out.
Thank you. So the files in the SH members will be wiped out by the contents of Deployer with the latest conf?
(will accept the answer).
Correct! SHC is strange, so I totally understand wanting to follow up to make sure this will work the way you expect/hope. http://docs.splunk.com/Documentation/Splunk/7.1.0/DistSearch/PropagateSHCconfigurationchanges contains more details about how precisely the deployer works.