Upgrade Splunk Industrial Asset Intelligence

Direct upgrade to 1.1.1 is not supported from any previous version. If you install version 1.1.1 on a Splunk Enterprise deployment with a previous version of Splunk Industrial Asset Intelligence (IAI) already installed, monitor views will not function. Instead, contact Splunk Support to initiate a migration procedure to back up and restore your data on a clean installation of Splunk IAI.

Pre-migration steps

Before the migration, navigate to $SPLUNK_HOME/etc/apps/splunk_app_iai/local/inputs.conf on *nix or %SPLUNK_HOME%\etc\apps\splunk_app_iai\local\inputs.conf directory on Windows. Make a copy of this file somewhere you can access it for reference.

Download version 1.1.1 of Splunk IAI from Splunkbase using your entitlement account.

Migration

Splunk Support assists you with performing the migration to preserve your data from your existing installation. To request the migration, log a case using the Splunk Support Portal.

Discuss with your Splunk Support contact what to expect from the data migration. If you migrate from versions older than version 1.1.0, not all of your custom configurations are included in the migration and you need to recreate calculated metrics and alerts in the new version. If you migrate from version 1.1.0 to 1.1.1, your calculated metrics and alerts are are included in the migration.

Post-migration steps

In previous versions, Splunk IAI checked for changes to your data association instructions once every minute. In version 1.1.1, Splunk IAI reduces this frequency to once every hour to ensure the data association has time to complete and to improve performance in other areas of the application. Any new data associations you create automatically use the new defaults. You need to make manual adjustments to any previously saved data associations.

After you complete the migration, make two manual changes to your saved data associations:

• Change the intervals to match the new default interval of one hour. This change ensures that the data association function has time to complete before restarting and enhances the performance of the application.
• If necessary, adjust the SPL in each stanza to limit your searches to the indexes you specified before the migration. If you migrate from a version older than 1.1.0, the migration procedure changes your searches to cover all indexes by default. Limiting these searches to specific indexes improves performance at scale. If you migrate from 1.1.0 to 1.1.1, the migration procedure does not adjust your SPL, and you do not need to take any action.

To make these two changes, follow the directions that match your deployment.

Post-migration data association changes for a single-instance deployment

Follow these steps on your single-instance deployment after the migration:

1. Navigate to the $SPLUNK_HOME/etc/apps/splunk_app_iai/local directory on *nix or %SPLUNK_HOME%\etc\apps\splunk_app_iai\local directory on Windows.
2. Open the inputs.conf file.
3. In each stanza that begins with asset_metrics_manager, change the values for interval and earliest_time as shown:

   earliest_time = -1h-5m
   interval = 0 * * * *

4. If you are migrating from a version older than 1.1.0, in each stanza that begins with asset_metrics_manager://metrics, change the search string in the SPL setting so that it specifies the indexes to search for that data association. For example, if your data for this data association comes from index1, change index=* to index=index1. If your data for this data association comes from index1 and index2, change index=* to index=index1 OR index=index2. Refer to the copy of the inputs.conf file that you saved from your previous version to see the index names for each stanza.
5. Save the file.
6. Restart the Splunk Enterprise instance.

Post-migration data association changes for multiple unclustered search heads

If your distributed search deployment uses unclustered search heads, follow these steps on each search head after the migration:

1. Navigate to the $SPLUNK_HOME/etc/apps/splunk_app_iai/local directory on *nix or %SPLUNK_HOME%\etc\apps\splunk_app_iai\local directory on Windows.
2. Open the inputs.conf file.
3. In each stanza that begins with asset_metrics_manager, change the values for interval and earliest_time as shown:

   earliest_time = -1h-5m
   interval = 0 * * * *

4. If you are migrating from a version older than 1.1.0, in each stanza that begins with asset_metrics_manager://metrics, change the search string in the SPL setting so that it specifies the indexes to search for that data association. For example, if your data for this data association comes from index1, change index=* to index=index1. If your data for this data association comes from index1 and index2, change index=* to index=index1 OR index=index2. Refer to the copy of the inputs.conf file that you saved from your previous version to see the index names for each stanza.
5. Save the file.
6. Restart the search head.

Post-migration data association changes for a search head cluster

If your distributed search deployment uses a search head cluster, follow these steps after the migration:

1. Make a copy of the local inputs.conf file for Splunk IAI from one of your search heads, which you can find in $SPLUNK_HOME/etc/apps/splunk_app_iai/local directory on *nix or %SPLUNK_HOME%\etc\apps\splunk_app_iai\local directory on Windows.
2. In each stanza that begins with asset_metrics_manager, change the values for interval and earliest_time as shown:

   earliest_time = -1h-5m
   interval = 0 * * * *

3. On your deployer, go to or create the $SPLUNK_HOME/etc/apps/splunk_app_iai/local directory on *nix or %SPLUNK_HOME%\etc\apps\splunk_app_iai\local directory on Windows.
4. If you are migrating from a version older than 1.1.0, in each stanza that begins with asset_metrics_manager://metrics, change the search string in the SPL setting so that it specifies the indexes to search for that data association. For example, if your data for this data association comes from index1, change index=* to index=index1. If your data for this data association comes from index1 and index2, change index=* to index=index1 OR index=index2. Refer to the copy of the inputs.conf file that you saved from your previous version to see the index names for each stanza.
5. Save the updated version of the inputs.conf file in the local directory.
6. Push the configuration bundle to update the inputs.conf on all search heads in the cluster.
7. Restart all search heads in the cluster.

See Use the deployer to distribute apps and configuration updates for more information about pushing updates using the configuration bundle.