Splunk Enterprise Security

Splunk ES Upgrade Compatibility

jaracan
Communicator

Just a quick question on Splunk Upgrade for ES

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/CompatMatrix

We are currently on Splunk ES v5.0.1 and Splunk Enterprise v7.0.13.1.

Now,we wanted to version upgrade to Splunk ES v5.3.1 and Splunk Enterprise v7.2.9.1.

With this, since we need to consider compatibility, do we need to upgrade to Splunk Enterprise v7.1.x first then upgrade Splunk ES App to v5.3.1, then we will upgrade to Splunk Enterprise v7.2.9.1 after? Is that correct? Or we can directly upgrade both from Splunk Enterprise v7.0.13.1 to v7.2.9.1 and Splunk ES App v5.0.1 to v5.3.1? Let me know which approach is correct.

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee
0 Karma

BainM
Communicator

Hi Jaracan-
We were on 6.63 in Enterprise and ES on 5.01. We upgraded our ClusterMaster first (to 7.2.x), then upgraded our SHC and at the same time upgraded ES to 5.3.1. After we confirmed 5.3.1 was happy, we upgraded our indexer cluster (to 7.2.x). Everything went fine after our Searchhead cluster calmed down. We had no issues with ES or our indexer cluster.

Hope this helps,
Mike

0 Karma

BainM
Communicator

Forgot to note: Our ES is NOT clustered and runs as an independent searchhead, querying our indexer cluster.

0 Karma

jaracan
Communicator

Hi BainM, does this means you have directly upgrade the Splunk Enterprise from 6.63 to v7.2.x starting with the Cluster Master, then upgraded the Splunk Enterprise version of the ES Search Head from 6.63 to v7.2.x and the ES App version from v5.0.1 to v5.3.1, and then after its good, you had upgraded the Splunk Enterprise version of the Peer Nodes/Clustered Indexers from 6.63 to v7.2.x. Is my understanding, correct?

0 Karma

BainM
Communicator

Correct.

We then upgraded the ES app after the main Splunk Ent. was at 7.2.x

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...