Splunk Enterprise upgrade to Splunk Enterprise 8.0

[cyberportnoc]

Currently we are running Splunk Enterprise 6.5.3 and want to upgrade to 8.0. The server OS is Ubuntu 14.04.1 LTS
We have the following questions:
1. Is it possible that upgrade directly to 8.0 from 6.5.3 ?
2. Is there any dependency need to be installed, such as java or Python ?

[cyberportnoc]

How about I export the database and configuration, install 8.0 on a new server and then import those data? Is it possible?

[dindu]

Hi,

1)You cannot directly upgrade from 6.x to 8.x.First, upgrade to 7.x and the proceed.6.x -->7.x -->8.x
2)Check for the kernel. Highly recommended to upgrade your ubuntu as its an old release.
3)There are no python dependencies or libraries for an upgrade. The latest python bundle that is 3.x will be within splunk.
Also, there is a dependency on the forwarders. Check for forwarder compatibility.
https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar...

[cyberportnoc]

How about I export the database and configuration, install 8.0 on a new server and then import those data? Is it possible?

[harsmarvania57]

Hi,

Have a look at upgrade table on https://docs.splunk.com/Documentation/Splunk/8.0.2/Installation/HowtoupgradeSplunk#Upgrade_informati... . You can't upgrade from 6.5 to 8.0 directly, first you need to upgrade splunk to 7.0 and then upgrade it to 8.0

Regarding operating system, splunk is dependant on kernel version so check whether you are running supported kernel version or not on Ubuntu 14.04 LTS. Ref doc : https://docs.splunk.com/Documentation/Splunk/8.0.2/Installation/Systemrequirements#Supported_Operati...

There are no python dependencies require on OS itself but splunk 8.0 run on python 3 so make sure that app/add-ons installed on your splunk instance supports python 3. For more documentation have a look at https://docs.splunk.com/Documentation/Splunk/8.0.2/Python3Migration/AboutMigration

Java is usually require if you are running Splunk DB Connect app and this is prerequisite of DB connect so no relation with Splunk 8.0

[cyberportnoc]

How about I export the database and configuration, install 8.0 on a new server and then import those data? Is it possible?

[harsmarvania57]

If you want to install 8.0 on new server and import all data and configuration it will be longer task. Also there are few changes in indexes, I don't know in which version it introduced but during upgrade there was message about "Migrating Indexes" which means splunk is doing some work on existing indexes. So I'll suggest to upgrade as per splunk recommendation (6.5 -> 7.0 -> 8.0).