This documentation does not apply to the most recent version of Splunk® Phantom (Legacy).
For documentation on the most recent version, go to the latest release.
Download topic as PDF
Upgrade an unprivileged standalone Splunk Phantom instance
Follow these steps to upgrade your unprivileged Splunk Phantom instance.
- Make sure you have read Splunk Phantom upgrade overview and prerequisites.
- Download the installation tar file from the Splunk Phantom Community portal. If you do not see the required file, contact Phantom support.
- Log in to the Splunk Phantom instance's operating system as the user account that runs Splunk Phantom. On an unprivileged virtual machine image or AMI-based deployment, this user account is "phantom."
- If you are using a warm standby, disable warm standby. See Upgrade or maintain warm standby instances in Administer Splunk Phantom.
- If you are using automation to run ibackup.pyc to make backups, cancel backups that could run during your upgrade window. For example, if you have configured a cron job to run ibackup.pyc, disable that cron job.
- Stop all Splunk Phantom services. For example, as the root user:
/home/<username>/<PHANTOM_HOME>/bin/stop_phantom.sh
- Delete the file
/tmp/phantomOvaUpgrade
.rm -f /tmp/phantomOvaUpgrade
- Clear the YUM caches. For example, as the root user:
yum clean all
- Update the operating system and installed packages. For example:
yum update --exclude=nginx
- Restart the operating system. For example, as the root user:
reboot
- After the system restarts, log in to the operating system as the user account that runs Splunk Phantom.
- Copy the installation tar file to the directory where Splunk Phantom was installed. This is the
PHANTOM_HOME
directory. - Extract the installation tar file. For example, as the user account that runs Splunk Phantom:
tar -xvzf phantom-<version>.tgz
- Run the upgrade script. If you don't want to upgrade your installed apps at during the upgrade, you can use the
<PHANTOM_HOME>/phantom_tar_install.sh upgrade
--without-apps
option.<PHANTOM_HOME>/phantom_tar_install.sh upgrade --without-apps
- After the upgrade is complete, from Main Menu > Administration > Administration Settings > Search Settings, select Playbooks from the drop-down menu, then click the Reindex Search Data button.
Last modified on 22 April, 2021
PREVIOUS Upgrade Splunk Phantom on a system with limited internet access |
NEXT Upgrade a Splunk Phantom cluster |
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8
Feedback submitted, thanks!