Hi @Naoki
If you are using a standalone SearchHead then yet you can upload via the UI, ticking the upgrade button - however you might hit issues due to the size of the tarball file being higher than the limits.conf set for file uploads.
To overcome this see the following snippet from https://splunk.my.site.com/customer/s/article/Python-for-Scientific-Computing
1) To upgrade via UI needs to change max_upload_size at path $SPLUNK_HOME/etc/system/local/web.conf:
[settings]
max_upload_size = 2048
2) For clustered environment, increase the bundle size to the same setting as max_content_length on the SHs as follow:
1. Navigated to /opt/splunk/etc/system/local/distsearch.conf on the server.
2. Append/Update the following parameters:-
[replicationSettings]
maxBundleSize = 2048 or 3072
3. Save the file and restart all SHs.
Alternatively you can copy it to the Splunk instance's app folder ($SPLUNK_HOME/etc/apps) overwritting the previous content.
If in any doubt please make a backup copy of the PSC app on your Splunk instance first.
🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
