Hi, I've upgrated the Splunk App for Lookup File Editing and now when I try to open a lookup from lookup editor, this is the message I get: This is the URL of the Load Balancer: https://<LOADBALANCER>.com/splunk/en-GB/app/lookup_editor/lookup_list   But when I hover the mouse over any lookup name or I click on it, splunk/en-GB misses I don't have this problem when I directly connect to a specific search head. Is there maybe a configuration I need to change?   Thank you in advance for any suggestion. Kind Regards   ... View more

Hi, what's the correct way to upgrade the Lookup Editor app without loosing lookups? Should I replace the current lookup_editor folder with the new one and then launch the command $SPLUNK_HOME$/bin/splunk apply shcluster-bundle -target http://<SHcaptain>:<port> -preserve-lookups true ? Or maybe I can just replace some of its folders or files? Is there something I need to keep or do in order not to loose old lookups? Thank you in advance for any help. ... View more

Hi everybody, I need to upgrade Splunk Enterprise from 7.3.X to 8.1.0 and then to 8.2.5 (Windows).  The architecture includes: - 1 cluster master - 1 search head - 2 indexers (cluster)  - 1 deployment servers - 1 heavy forwarder - n universal forwarders Looking at the documentation, these are the steps to follow: Download the MSI file to the host. Double-click the MSI file. The installer runs and attempts to detect the existing version of Splunk Enterprise installed on the machine. When it locates the prior installation, it displays a panel that asks you to accept the licensing agreement. Accept the license agreement. The installer then installs the updated Splunk Enterprise. This method of upgrade retains all parameters from the existing installation. The installer restarts Splunk Enterprise services when the upgrade is complete, and places a log of the changes made to configuration files during the upgrade in %TEMP%. Shouldn't I stop the the splunk service before? Do I only need to double click on the installer and follow the wizard on each host? That's it? Is there something that I'm missing?   About Splunk apps and add-ons: I need to update some of them, should I do it before or after the Splunk upgrade? Example: Add-on for VMware ESXi Logs is now 3.4.2 and needs to be upgraded to 4.0.3 (which doesn't support Splunk 7.X). I think I should upgrade Splunk first, then add-ons and apps, correct?   Thanks in advance for any help. ... View more

Hello everybody, I am upgrading Splunk Enterprise from 7.3.X to 8.2.5 (Windows). Due to the compatibility, I also need a more recent Windows version on my hosts to support Splunk. Therefore, I'm gonna use a new host for each server. The architecture includes: - 1 cluster master - 1 deployment servers - 1 search head - 2 indexers (cluster) - 1 poller (heavy forwarder) - n universal forwarders I've found HERE how to migrate a Splunk Enterprise instance from one physical machine to another, can anybody confirm me the following procedure? - Stop Splunk Enterprise services on the host from which I want to migrate - Roll any hot buckets on the source host from hot to warm - Copy the entire contents of the $SPLUNK_HOME directory and all the directories containing buckets from the old host to the new one - Turn off the old host - Configure the new host in order to have the same IP address and hostname of the old host. This avoid not to redirect forwarders to the new instance - Install Splunk Enterprise 7.3.X on the new host - Verify that the index configuration (indexes.conf) file's volume, sizing, and path settings are still valid on the new host. - Start Splunk Enterprise on the new instance. - Log into Splunk Enterprise and confirm that your data is intact by searching it - Upgrade from 7.3.X to 8.1.X and then to 8.2.5 Should I apply these steps to every host? What about the two indexers? I'm gonna need to migrate data, what's the correct procedure? Also, I'm afraid that the new installation would reingest data from the poller, should I do something to prevent it? Last thing: I'm gonna probably need to change the IP of one indexer, when should I change its configurations?   Thanks in advance for any help. ... View more