Installation

Question about uninstall/reinstall of UF

jeffbat
Path Finder

This is on a Windows Server.

If we do an uninstall of the UF on the server and then reinstall a newer UF version on the server, when it gets its apps pushed back down to it from the deployment server; will it reread all of the logs that it might have already processed before?

Things like the Windows Eventlogs System/Security/Application logs?

I am working with one of our teams that is building out a method of request for getting agents onto a new server and then pushing out the inputs it will collect.  One of the steps utilized from other agents (different tools) that this process would emulate is for when a new request to make a change to an existing server would be to uninstall an existing agent and then install the latest version we have in our build process.

I am worried that if this is done then it would go back and reread all of the log events in any logs that the server would have setup for reading.

I have currently had them not do this process for Splunk UF and am looking to have them just do a check on the currently installed Splunk version and only run an upgrade if needed (not uninstall/reinstall).

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
It depends on how the UF is uninstalled. If the fishbucket is deleted then the new installation will not know where the old UF left off and will re-read data.
I prefer to install new versions on top of the old version.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
It depends on how the UF is uninstalled. If the fishbucket is deleted then the new installation will not know where the old UF left off and will re-read data.
I prefer to install new versions on top of the old version.
---
If this reply helps you, Karma would be appreciated.
0 Karma

jeffbat
Path Finder

Thanks.

That was what I was thinking.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...