Deployment Architecture

What is the recommended compatibility sequence of upgrading instances in my environment from Splunk 6.2.7 to 6.3.2?

rcreddy06
Path Finder

I have a deployment server, clustered Indexers, clustered search heads, heavy forwarders, & universal forwarders. All are running Splunk 6.2.7 and would like to upgrade to Splunk 6.3.2

I believe the compatibility sequence should be:
Cluster Master > Search Heads > Indexers > Heavy forwarders > Universal Forwarders and deployment server should be upgraded along with search heads or before cluster master.

I can't upgrade all servers on the same day. Please suggest compatibility of Splunk instances.

1 Solution

esix_splunk
Splunk Employee
Splunk Employee

You can break down your upgrade in to phases.

First should be your Cluster Master Node.

Second, should be Search Tier. Upgrade the instances individually, or if you are on a SHC, you need to upgrade the whole cluster.

Next would be the indexing tier:

Put your CM in to Maintenance Mode, upgrade it, restart, put back into maintenance mode. Upgrade all your indexers, once upgraded, take the CM out of Maintenance mode. This is a good check point to make sure your Cluster(s) rebalance and are reporting in correctly.

Your DS / HF / UF can be upgraded as time permits, they dont have specific version requirements. (Although check the DS, if you're using some legacy configuration settings, they may be deprecated.)

Make note, there are some version requirements between the Search and Indexing tiers to be cautious about..

Upgrading : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/HowtoupgradeSplunk
Upgrading Version Notes : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/Aboutupgradingto6.3READTHISFIRST
Version Compatibility : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

You can break down your upgrade in to phases.

First should be your Cluster Master Node.

Second, should be Search Tier. Upgrade the instances individually, or if you are on a SHC, you need to upgrade the whole cluster.

Next would be the indexing tier:

Put your CM in to Maintenance Mode, upgrade it, restart, put back into maintenance mode. Upgrade all your indexers, once upgraded, take the CM out of Maintenance mode. This is a good check point to make sure your Cluster(s) rebalance and are reporting in correctly.

Your DS / HF / UF can be upgraded as time permits, they dont have specific version requirements. (Although check the DS, if you're using some legacy configuration settings, they may be deprecated.)

Make note, there are some version requirements between the Search and Indexing tiers to be cautious about..

Upgrading : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/HowtoupgradeSplunk
Upgrading Version Notes : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/Aboutupgradingto6.3READTHISFIRST
Version Compatibility : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...

rcreddy06
Path Finder

From: http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...
Cluster master should be upgraded before search heads, then indexers.

Lucas_K
Motivator

^ this!

Very bad things happen if you do search heads first.

We had a situation when another admins search head got a day one upgrade without us knowing.

We suddenly had indexers start going offline due to incompatibilities. It was the first time we had search head causing indexer outages.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Thanks for the call out, updated.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...