hi thx for the reply but, no not quite. In windows the MSI will install while splunk is running and restart it after its done. But in linux its a TGZ extract (not locking it to a specific distro using rpms or debs etc).  Extracting it while running causes a lot of errors and sometimes succeeds but not reliable.   So a very highlevel sequence is this   1. do all checks 2. stop splunk 3. create backup script dies when splunk stops so a partial backup is made.  4. untar new 5. restart with accept lic and answer yes ill add, that when i run it manually it works fine. ... View more

cuz I'd like to shut it down, back it up, upgrade it and restart it. ... View more

Thanks.    I tried this is some slight mods and it appears to give me results. It's going to take some effort to verify the results and I'm not sure how its handling multiple logins at the moment. But for now its got me in the right direction.   ... View more