- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Fellow Splunkers,
So a more general question: what are the best practices for upgrades around security patching and deployment in a distributed production environment.
We have SHs and ndexers clustered.
I can clarify if this is unclear. Appreciate any advice and shared experiences.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
You probably are familiar with this document https://lantern.splunk.com/Splunk_Platform/Product_Tips/Upgrades_and_Migration/Upgrading_the_Splunk_... ?
In general how I see this.
Usually there should be release/change management process in place. Also you should have some kind of road map for your splunk environment, which are taking care of those regular splunk patching and upgrades. Usually I prefer 1-2 updates per year and over those needed urgent security upgrades based on content of those unless those cannot wait for regular patching window.
For security patches you should follow Splunk security page https://advisory.splunk.com/?301=/en_us/product-security.html and also Splunk's slack has e.g. https://splunk-usergroups.slack.com/archives/C1S5BEF38 (#security) and https://splunk-usergroups.slack.com/archives/C047WPATG (#announcements) channels. From those channels you will get notices when there is some issues found.
If/when you have distributed environment or more than one server, you should have some kind of automation which applies needed standards etc. to your environment and operation processes.
r. Ismo
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ismo,
Appreciate the response.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
You probably are familiar with this document https://lantern.splunk.com/Splunk_Platform/Product_Tips/Upgrades_and_Migration/Upgrading_the_Splunk_... ?
In general how I see this.
Usually there should be release/change management process in place. Also you should have some kind of road map for your splunk environment, which are taking care of those regular splunk patching and upgrades. Usually I prefer 1-2 updates per year and over those needed urgent security upgrades based on content of those unless those cannot wait for regular patching window.
For security patches you should follow Splunk security page https://advisory.splunk.com/?301=/en_us/product-security.html and also Splunk's slack has e.g. https://splunk-usergroups.slack.com/archives/C1S5BEF38 (#security) and https://splunk-usergroups.slack.com/archives/C047WPATG (#announcements) channels. From those channels you will get notices when there is some issues found.
If/when you have distributed environment or more than one server, you should have some kind of automation which applies needed standards etc. to your environment and operation processes.
r. Ismo
