Deployment Architecture

What is the recommended compatibility sequence of upgrading instances in my environment from Splunk 6.2.7 to 6.3.2?

rcreddy06
Path Finder

I have a deployment server, clustered Indexers, clustered search heads, heavy forwarders, & universal forwarders. All are running Splunk 6.2.7 and would like to upgrade to Splunk 6.3.2

I believe the compatibility sequence should be:
Cluster Master > Search Heads > Indexers > Heavy forwarders > Universal Forwarders and deployment server should be upgraded along with search heads or before cluster master.

I can't upgrade all servers on the same day. Please suggest compatibility of Splunk instances.

1 Solution

esix_splunk
Splunk Employee
Splunk Employee

You can break down your upgrade in to phases.

First should be your Cluster Master Node.

Second, should be Search Tier. Upgrade the instances individually, or if you are on a SHC, you need to upgrade the whole cluster.

Next would be the indexing tier:

Put your CM in to Maintenance Mode, upgrade it, restart, put back into maintenance mode. Upgrade all your indexers, once upgraded, take the CM out of Maintenance mode. This is a good check point to make sure your Cluster(s) rebalance and are reporting in correctly.

Your DS / HF / UF can be upgraded as time permits, they dont have specific version requirements. (Although check the DS, if you're using some legacy configuration settings, they may be deprecated.)

Make note, there are some version requirements between the Search and Indexing tiers to be cautious about..

Upgrading : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/HowtoupgradeSplunk
Upgrading Version Notes : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/Aboutupgradingto6.3READTHISFIRST
Version Compatibility : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

You can break down your upgrade in to phases.

First should be your Cluster Master Node.

Second, should be Search Tier. Upgrade the instances individually, or if you are on a SHC, you need to upgrade the whole cluster.

Next would be the indexing tier:

Put your CM in to Maintenance Mode, upgrade it, restart, put back into maintenance mode. Upgrade all your indexers, once upgraded, take the CM out of Maintenance mode. This is a good check point to make sure your Cluster(s) rebalance and are reporting in correctly.

Your DS / HF / UF can be upgraded as time permits, they dont have specific version requirements. (Although check the DS, if you're using some legacy configuration settings, they may be deprecated.)

Make note, there are some version requirements between the Search and Indexing tiers to be cautious about..

Upgrading : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/HowtoupgradeSplunk
Upgrading Version Notes : http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/Aboutupgradingto6.3READTHISFIRST
Version Compatibility : http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...

rcreddy06
Path Finder

From: http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Systemrequirements#Splunk_Enterprise_versi...
Cluster master should be upgraded before search heads, then indexers.

Lucas_K
Motivator

^ this!

Very bad things happen if you do search heads first.

We had a situation when another admins search head got a day one upgrade without us knowing.

We suddenly had indexers start going offline due to incompatibilities. It was the first time we had search head causing indexer outages.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Thanks for the call out, updated.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...