Splunk Universal Forwarder Version Update

[Chirag812]

I need to upgrade the Splunk Universal forwarder version to all the existing installed windows 2016 and 2019 servers. I am using Splunk Enterprise as a Search head and indexer.

Is there a way that I can upgrade the old version with the latest without uninstalling the old and install the new one. And how this task can be done for all the servers together instead of one by one.

[gcusello]

Hi @Chirag812 ,

at first you don't need to uninstall the old version,

and anyway you can follow the instructions at https://docs.splunk.com/Documentation/Forwarder/9.4.0/Forwarder/Upgradetheuniversalforwarder , you can upgrade your UFs using a deployment tool such as Group Policy or System Center Configuration Manager.

Officially Splunk don't  support UF binary upgrade via DS., fortunately this feature seems to be in development phase https://ideas.splunk.com/ideas/EID-I-70.

you can use two apps from Splunkbase:

• for nix Forwarders https://splunkbase.splunk.com/app/5004
• for windows Forwarders https://splunkbase.splunk.com/app/5003

the only limitation is that they are archived. 

Ciao.

Giuseppe

[isoutamo]

Hi

Basically you shouldn't uninstall previous versions when you are upgrading. If you uninstall it first then you are losing also fishbucket db which keep track ingested events. Basically that means reinvesting all files etc.

When you are updating UF version you should follow the same version path as defined for full enterprise. And remember to restart after every version update as otherwise e.g. DB conversions hasn't done.

As @gcusello said there is a new feature which allow update those UF binaries. Currently it's a beta or restricted to some customers. You could see more from voc.splunk.com.

If you have some other system management tools, then you can use those to update binaries, but again you must add needed steps to those workflows.

r. Ismo