What would be the proper upgrade path for this Tenable vulnerability coming from 9.3.3?

[danielbb]

We have a Splunk environment of over 20+ servers, and they are all consistently running Splunk version 9.3.3 Core & UF. Recently, this Tenable vulnerability emerged for a few of them.

The solution on the linked vulnerability page claims that we need to upgrade to versions 10.0.1, 9.4.5, 9.3.7, 9.2.9, or higher.

So we wonder, what would be the recommended/proper upgrade path we should take, considering the fact that we don't want to fall behind version-wise, because Splunk has already reached the 10.x versions, while we are still on the 9.x?

[PrewinThomas]

@danielbb 

As @livehybrid  mentioned, The fastest, safest, and least disruptive way to do this is to upgrade from 9.3.3 to 9.4.5.
Then you can plan the jump to the 10.x. This is a major version upgrade and requires more planning.
Test Upgrade to 10.x on (dev/staging servers) and validate Splunk apps, add‑ons, and custom scripts against Splunk 10 changes and then plan to upgrade UF's also.

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid]

Hi @danielbb 

You can upgrade from 9.3.3 directly to 10.0.1, the docs for this version arent super clear (https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.0/upgrade-or-migrate...) but they do confirm that you can go from 9.3.x to the latest 10.0.x version.

Alternatively you could upgrade the the latest 9.3.x or 9.4.x versions if you arent wanting to move to 10.0.x

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing