- Find Answers
- :
- Splunk Platform
- :
- Splunk Enterprise
- :
- Re: Splunk upgrade to 9
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have a plan to upgrade spunk to version 9.* from 8.2, but we are using Splunk Universal Forwarder 7.1.0. Splunk enterprise will be compatible with Splunk Universal Forwarder 7.1.0 or do we have to upgrade Splunk Universal Forwarder to version 9.*?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no Splunk solution for UF upgrade managment, however it may be added into Splunk in future.
There is a script below that you can adapt and use, but it comes with no support. You may also consider SCCM for upgrading the UF, or Puppet for example.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
7.x is supported, but only just.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can we upgrade Splunk to version 9.* without upgrading Splunk forwarder?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, for events and metrics.
If you have HEC/HTTPOUT requirements, then you should upgrade the UF tier after the indexers are upgraded.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we have 100 windows machines, how to upgrade UF on all machines?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no Splunk solution for UF upgrade managment, however it may be added into Splunk in future.
There is a script below that you can adapt and use, but it comes with no support. You may also consider SCCM for upgrading the UF, or Puppet for example.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
