Upgrade a single privileged instance

Follow these steps to upgrade your instance.

Use the TAR file for Splunk SOAR (On-premises) release 5.3.6 to upgrade your privileged Splunk Phantom 4.10.7 or Splunk SOAR (On-premises releases 5.0.1 through 5.3.4. Do not use this TAR file to create a new deployment.

1. Visit the web site to register and create an account. After have signed up, you can download installation packages from the Free Trial button.
2. Read upgrade overview and prerequisites.
3. Prepare your system for upgrade. See Prepare your Splunk SOAR (On-premises) deployment for upgrade.
4. Restart the operating system if you did not recently restart it as part of the preparations in Step 3.
   This step is required to ensure that the upgrade completes successfully and efficiently.
   As the root user:

   reboot

5. After the system restarts, log in to the operating system as either the root user or a user with sudo privileges.
6. Remove any previous upgrade's <$PHANTOM_HOME>/splunk-soar directory.

   rm -rf <$PHANTOM_HOME>/splunk-soar

7. Download the privileged installer from the instructions sent to you by Support. The installer is packaged with static versions of the product's dependencies when the product is built. The installer is named in the format splunk_soar-priv-<major>.<minor>.<patch>.<build>-<commit_short_sha>-el7-x86_64.tgz
8. Extract the TGZ file you downloaded into the /opt/phantom directory using tar -xf <installer>.tgz .
9. Make sure that that your current installation of is running.

   <$PHANTOM_HOME>/bin/start_phantom.sh

10. Change directory to the <$PHANTOM_HOME>/splunk-soar directory.

    cd <$PHANTOM_HOME>/splunk-soar

11. The installer package you extracted creates a file called soar-install in the <$PHANTOM_HOME>/splunk-soar directory. Run that script:

    ./soar-install --upgrade --with-apps

    You can see the full list of arguments for the soar-install script by using the --help option.

12. After the upgrade is complete, remove installation package by deleting the <$PHANTOM_HOME>/splunk-soar directory.

    rm -rf <$PHANTOM_HOME>/splunk-soar