Hello @PramodhKumar
to delete an entry in the rpm database without deleting the rpm package you can use
rpm -e --justdb splunk
Difference between tgz and rpm: tgz is a tar archive, it is like a ZIP archive that additionally can preserve linux permissions and store special file types like links.
We are thinking to upgrade using tarball - what are your reasons to switch from rpm to tgz?
OS still lists old package for this command "rpm -qa | grep splunk" - since you changed files outside of rpm DB, from the rpm's database point of view your splunk installation is inconsistent with a reference information.
can i just remove that package by rpm -e after up gradation? - don't do this (unless you have a backup), it will remove 99% of files in /opt/splunk folder
Or should I go with rpm up gradation only? - yes please, unless you have good reasons to switch to tgz.
I can imagine a tgz over rpm will work if you know what you are doing.
Technically a tgz file contains the same files as rpm, but rpm does some extra work for you during the install/upgrade/uninstall:
checks prerequisites
adds user and group splunk
detects if it is an install and gratefully stops running splunk
etc.
Advantages of rpm/deb packages :
easy to install/deinstall
correct permissions (forget about chown/chmod -R)
easy to upgrade/downgrade
easy to verify that the package was installed correctly
easy to check which files were changed (rpm -V packagename)
... View more