Splunk Enterprise

upgrade splunk in a distributed environment

Path Finder

Hi All, 

I am planning to upgrade Splunk Enterprise from version 7.3.3 to latest available version in Linux servers . Basically , its a distributed environment with multi-site Splunk Indexer cluster, search head cluster with a cluster master, deployment server, , and deployer. 

Someone, please show me the exact path for these upgrade procedure. Please reply for the following.

1.  How to upgrade multi-site indexer cluster?

2. how to upgrade search head cluster and cluster master?

3. How to upgrade deployment server?

4. How to upgrade deployer?

5. what are the backup procedures and measures to be taken while upgrading?

6. What are the best practices to be followed while upgrading?

7. What is the order of upgrade?

8. What are the common issues faced while upgrading the license master, indexer, search head and all?


Grab some energy and please help me in answering these questions. 

Thanks in Advance.


Labels (1)
0 Karma


1.  See https://docs.splunk.com/Documentation/Splunk/8.1.2/Installation/AboutupgradingREADTHISFIRST , https://docs.splunk.com/Documentation/Splunk/8.1.2/Installation/UpgradeyourdistributedSplunkEnterpri... and https://docs.splunk.com/Documentation/Splunk/8.1.2/Indexer/Searchablerollingupgrade

2.  See https://docs.splunk.com/Documentation/Splunk/8.1.2/DistSearch/UpgradeaSHC

3.  See https://docs.splunk.com/Documentation/Splunk/8.1.2/Installation/AboutupgradingREADTHISFIRST and https://docs.splunk.com/Documentation/Splunk/8.1.2/Installation/HowtoupgradeSplunk

4. See #3.

5.  I usually don't bother with backups since the upgrade procedure is nearly flawless.  If you prefer to bac up first then use your preferred backup method to copy $SPLUNK_HOME, excluding $SPLUNK_DB.

6.  Don't upgrade to version 8 without first installing and running the Splunk Upgrade Readiness app.  Read the Release Notes for relevant changes.  Read and follow the installation instructions.

7.  See Perform a rolling upgrade

8.  The most common issue is it just works.  Other issues arise with Splunk 8 because the use failed to upgrade their apps to a version compatible with Splunk 8.

If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...