Splunk Enterprise

Update from 6.0 to 6.0.1

bowesmana
SplunkTrust
SplunkTrust

I've just noticed that 6.0.1 is released. I have a 6.0 tarball install. Not having done this before, is the normal way to update to 6.0.1 just to untar the new version on top of the old. I am assuming this will not overwrite my config. I have not made any changed to the default branch of any directories.

Naturally I will backup first...

Tags (1)
0 Karma
1 Solution

guilmxm
Influencer

Hi,

That's no big deal, and the answer is NO you won't loose your change:

  • custom config files in "local" dir (eg. system/local...)
  • App installed ans associates files
  • indexes...

But if you have modified system files whitout creating the overwritten version in local dirs, yes these changes will probably be lost.

As for an example, if you have custom limits configuration, don't modify system/defaults/limits.conf but create a new files including your setting in system/local/limits.conf

To upgrade from previous release when you installed through the tarball Archive:

  1. Stop Splunk

  2. Backup your current install using tar

  3. Extract the tar.gz where splunk is installed, only splunk files will be overwritten, you won't loose any thing. (even if backing up is always a good idea)

Let's say you installed by default, splunk is installed in /opt/splunk

In terminal, go at top of splunk dir (cd /opt) and extract files (tar -xvf )

  1. Start Splunk and accept changes

View solution in original post

guilmxm
Influencer

Hi,

That's no big deal, and the answer is NO you won't loose your change:

  • custom config files in "local" dir (eg. system/local...)
  • App installed ans associates files
  • indexes...

But if you have modified system files whitout creating the overwritten version in local dirs, yes these changes will probably be lost.

As for an example, if you have custom limits configuration, don't modify system/defaults/limits.conf but create a new files including your setting in system/local/limits.conf

To upgrade from previous release when you installed through the tarball Archive:

  1. Stop Splunk

  2. Backup your current install using tar

  3. Extract the tar.gz where splunk is installed, only splunk files will be overwritten, you won't loose any thing. (even if backing up is always a good idea)

Let's say you installed by default, splunk is installed in /opt/splunk

In terminal, go at top of splunk dir (cd /opt) and extract files (tar -xvf )

  1. Start Splunk and accept changes

laserval
Communicator

Will splunk-launch.cfg also be overwritten by an update? I suspect so.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Great answer, thanks guilmxm, just what I was looking for.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...