Installation

Question about uninstall/reinstall of UF

jeffbat
Path Finder

This is on a Windows Server.

If we do an uninstall of the UF on the server and then reinstall a newer UF version on the server, when it gets its apps pushed back down to it from the deployment server; will it reread all of the logs that it might have already processed before?

Things like the Windows Eventlogs System/Security/Application logs?

I am working with one of our teams that is building out a method of request for getting agents onto a new server and then pushing out the inputs it will collect.  One of the steps utilized from other agents (different tools) that this process would emulate is for when a new request to make a change to an existing server would be to uninstall an existing agent and then install the latest version we have in our build process.

I am worried that if this is done then it would go back and reread all of the log events in any logs that the server would have setup for reading.

I have currently had them not do this process for Splunk UF and am looking to have them just do a check on the currently installed Splunk version and only run an upgrade if needed (not uninstall/reinstall).

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
It depends on how the UF is uninstalled. If the fishbucket is deleted then the new installation will not know where the old UF left off and will re-read data.
I prefer to install new versions on top of the old version.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
It depends on how the UF is uninstalled. If the fishbucket is deleted then the new installation will not know where the old UF left off and will re-read data.
I prefer to install new versions on top of the old version.
---
If this reply helps you, Karma would be appreciated.
0 Karma

jeffbat
Path Finder

Thanks.

That was what I was thinking.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...