Getting Data In

How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

Suyalag
New Member

Hi,

I have set up a deployment server with a test app directory under etc/deployment-app along with a default inputs.conf. It also has a local folder and an app.conf auto generated file. Then I have a default serverclass.conf under etc/system/local. I also have a deployment-client.conf file set up on the forwarders. The clients are connecting to the server fine and also saying that the clients are deployed, but it is not updating the forwarder from version 6.2 to 6.4. Am I missing a step that is preventing it from updating the forwarder?

Also, I have the rmp file in the etc/deployment-app/testapp folder.
Please let me know what I am doing wrong.

Thank you for your help.
Gary

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

As somesoni2 points out, you cannot use the Deployment Server to upgrade an actual Splunk instance { Enterprise or UF. } The deployment server is only used for managing installled apps within the client, not the actual client.

With that in mind, you need to rely on automation or manual processes to upgrade the actual client.

On a side note, when you upgrade, your deployment server configuration will be preserved and not deleted, so you can do in place upgrades and not have to worry about the clients loosing the deployment server configurations.

View solution in original post

chrismewett
Explorer

There's now a splunk blog post on doing exactly this for linux forwarders (to match @mikehodges01 approach for windows, viz:
https://www.splunk.com/blog/2017/04/28/upgrading-linux-forwarders-using-the-deployment-server.html

mikehodges01
Explorer

I'm doing exactly this. Write a script and refer to it in an inputs.conf.

I have an app folder "WinUpdate", then I have "default" and "bin". In \default is an inputs.conf that says [script://..\bin\installer.bat]. Under \bin I place the forwarder MSI and an install script that checks the currently installed version of Splunk against a copy of splunk.version I put in \bin as well. If they're different, the script executes and upgrades the UFs. Get a little creative! Splunk can do almost anything you need it to do. This method works perfectly for me.

mhsears418
New Member

awesome MikeH. You mention an install script that checks if versions are different. could you post that or get example to me?

0 Karma

mikehodges01
Explorer

I used to get the output of splunk.exe version and put it in a file that I distributed with the app, then issue that same command in my script on the target machine and dump the output to a temp file, and then use Windows fc to compare the files. If they're different, run the upgrade. Now I'm upgrading to a Powershell script that uses a regex match to pull the version from etc\splunk.version on the target machine and the MSI I include in the app to see if they're the same.

[regex]$regex = "\d\.\d\.\d"

mhsears418
New Member

Mike, so is your hierarchy like this? C:\ProgramFiles\Splunk\etc\apps\WinUpdate\Default
C:\ProgramFiles\Splunk\etc\apps\WinUpdate\Default

Or C:\ProgramFiles\Splunk\etc\apps\WinUpdate\
C:\ProgramFiles\Splunk\etc\apps\Default
C:\ProgramFiles\Splunk\etc\apps\Bin

0 Karma

cboillot
Contributor

@mikehodges01 could you share the Script?

0 Karma

mhsears418
New Member

ok very cool info...appreciate it.

0 Karma

ppeterson
Path Finder

I'd love to see the powershell script you have or a partial as i"ll be needing to do the same.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As somesoni2 points out, you cannot use the Deployment Server to upgrade an actual Splunk instance { Enterprise or UF. } The deployment server is only used for managing installled apps within the client, not the actual client.

With that in mind, you need to rely on automation or manual processes to upgrade the actual client.

On a side note, when you upgrade, your deployment server configuration will be preserved and not deleted, so you can do in place upgrades and not have to worry about the clients loosing the deployment server configurations.

Michael
Contributor

ha! Great, I read this now. That was a large part of our decision to go with a deployment server architecture....

0 Karma

somesoni2
Revered Legend

AFAIK, you can't upgrade Splunk version on deployment client using deployment server. You would have to use regular methods that you use in your Company to upgrade those (manually on each server, OR using some remote script execution method like upush OR puppet etc). http://docs.splunk.com/Documentation/Splunk/6.4.3/Updating/Configuredeploymentclients#Upgrade_a_depl...

Suyalag
New Member

not upgrading the splunk enterprise version just splunk forwarder from a splunk enterprise instance. Can i not do that either?

0 Karma

chrismewett
Explorer

There have been developments over the last few months - check out the other comments on the thread.

0 Karma

somesoni2
Revered Legend

Product version, whether it's a Splunk Enterprise OR Splunk Universal Forwarder, upgrade is not possible through Deployment server.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...