Upgrade Best Practices for Splunk Enterprise (9.1.2)

[JohnEGones]

Hi Fellow Splunkers,

So a more general question: what are the best practices for upgrades around security patching and deployment in a distributed production environment.

We have SHs and ndexers clustered.

I can clarify if this is unclear. Appreciate any advice and shared experiences.

[JohnEGones]

Ismo,

Appreciate the response.

[isoutamo · Accepted solution]

Hi

You probably are familiar with this document https://lantern.splunk.com/Splunk_Platform/Product_Tips/Upgrades_and_Migration/Upgrading_the_Splunk_... ?

In general how I see this. 

Usually there should be release/change management process in place. Also you should have some kind of road map for your splunk environment, which are taking care of those regular splunk patching and upgrades. Usually I prefer 1-2 updates per year and over those needed urgent security upgrades based on content of those unless those cannot wait for regular patching window. 

For security patches you should follow Splunk security page https://advisory.splunk.com/?301=/en_us/product-security.html and also Splunk's slack has e.g. https://splunk-usergroups.slack.com/archives/C1S5BEF38 (#security) and https://splunk-usergroups.slack.com/archives/C047WPATG (#announcements) channels. From those channels you will get notices when there is some issues found.

If/when you have distributed environment or more than one server, you should have some kind of automation which applies needed standards etc. to your environment and operation processes.

r. Ismo