Hi @dconverse  You could track the status here and find relevant info for your products in use. https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html --- An upvote would be appreciated if this reply helps! ... View more

$SPLUNK_HOME/etc contains all of your settings and apps, so that is what I backup when doing an upgrade. ... View more

You should also back up your indexed data. See Back up indexed data in the Managing Indexers and Clusters of Indexers manual. With your /etc directory and your indexed data backed up, it should be straightforward to reinstall the earlier release and then copy the backed-up information into it. ... View more