Splunk Upgrade

[maheshnc]

I am new as splunk administrator here in the company.  we are using Splunk enterprise and the current version is 9.2.4, and as per splunk document this version is supported until Jan 31 2026, can somebody guide me on  version upgrade, and also which version should we upgrade? Also, I am not sure about the risk in upgrading the version, please provide your suggestions.

[isoutamo]

Additional to other instructions, here is Splunk's best practice documentation for upgrade https://lantern.splunk.com/Manage_Performance_and_Health/Upgrading_the_Splunk_platform

[thahir]

@maheshnc 

Please refer this url https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Ent... 

[richgalloway]

For instructions on how to upgrade Splunk Enterprise, read the fine manual at https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.4/upgrade-or-migrate-...

The choice of which version to install is yours.  I recommend a later version of 9.4.x.  This will help you prepare for Splunk 10 without the risk of the same.

IMO, the risk of upgrading usually is less than that of not upgrading and being on an unsupported version.  Splunk 10 is an exception since it contains many breaking changes for which careful planning is recommended.

[maheshnc]

Could you let me know about the version compatibility for various instances, I mean can we indexers, search heads and Heavy forwarders with different versions or should they have the same version?

[PickleRick]

Ideally, in a supported environment, all "main" components should be in the same version. You can get away with HFs running older versions (which is sometimes required if you have legacy systems for which you are using some legacy apps).

The order of upgrade can be deduced from the Installation Manual (and is charted in the post referenced somewhere else in this thread) but it can get tricky if your components have multiple roles.

Don't get me wrong but if you don't know nothing about upgrading Splunk and don't even know how to make a backup copy, maybe it's time to engage your local friendly Splunk Partner for this one and in the meanwhile set up a lab environment and train there before going all-in into the prod.

[thahir]

@maheshnc

Yes, ideally all your Splunk components—indexers, search heads, deployers, cluster managers, and heavy forwarders—should run the same version and its recommended from Splunk.

Refer the below URL for Compatibility matrix: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-p... 

For forwarders (both Universal and Heavy), Splunk officially supports a compatibility window where forwarders can be up to two major versions older than your indexers. You can find Splunk’s detailed compatibility guidelines at the official documentation link you referenced, which covers all combinations and exceptional scenarios.

refer the below url: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-p... 

High Level upgrade plan

-> Pre check

Apps/TA compatibility with the new version which you going to upgrade

Backup the Splunk etc folder, certs and KV store

-> follow the upgrade sequence order

-> Post upgrade: verify the cluster health and review the splunkd logs, if you have DMC in your infra go through the          console and do the health check

[maheshnc]

Could you please walk me through the backups needs to be taken/mandatory

[thahir]

@maheshnc , Backup the entire $SPLUNK_HOME/etc/ directory. basically it will cover all of your config related files.

[maheshnc]

what should be sequence for upgrading? could you suggest the precautions to be taken which may overcome the risk as I am doing this upgrade for the first time.