We just upgraded our Test environment (HF & DS) prior to thinking about doing Prod. On Ubuntu (Ubuntu 24.04.4 LTS) 9.3.2 >> 10.0.9 >> 10.4.2 So far the main issue we came across was when we tried the upgrade on one host the automatic kvstore upgrade to 7.x failed (when you go from 9.3.2 >> 10.0.9). Not sure this is a fix for everyone and not sure if this is right one, but for us as we use a custom cert chain for sslRootCAPath so we had to bundle the Splunk CA to the chain. I think the issue was related to errors we saw from the mongodb logs when trying to connect to the KV store. SSL peer certificate validation failed: self signed certificate in certificate chain Then updated our server.conf # /opt/splunk/etc/system/local/server.conf [sslConfig] sslRootCAPath = $SPLUNK_HOME/etc/auth/combinedCAchain.pem This allowed the kvstore upgrade to continue and then the second upgrade to >>10.4.2 Our second issue is one of our Test Heavy Forwarders has no started to have a upwards trend in memory usage, but have not figured out why yet.
... View more
