Updating 2.1.x to 2.2.x

Updating 2.1.x to 2.2.x

These instructions apply to Splunk 2.1 and later releases. To update a 2.0.x release see the migration instructions.

Step 1

Stop the Splunk Server by running this command on its host.

# $SPLUNK_HOME/bin/splunk stop

Step 2

Create a backup of your $SPLUNK_HOME/etc directory in an alternate location

# cp -r $SPLUNK_HOME/etc /foo/etc.bak

Step 3

Use the upgrade instructions for your package.

RPM

# rpm -U splunk-2.2.i386.rpm

deb

# dpkg -i splunk-2.2-linux-2.6-intel.deb

``FreeBSD``

# pkg_add splunk-2.2-freebsd-5.4-intel.tgz

``MacOS``

• GUI update:

Double-click on splunk.pkg

• Override the default installation directory /Applications/splunk:

When the installer gets to the Select Destination dialog, click Choose... to select a directory other than /Applications

• Command-line update:

# installer -pkg splunk.pkg

• Command-line update to a different disk or partition:

# installer -pkg splunk.pkg -target /Volumes/LaCie\ Disk

-target specifies a target volume, such as another disk, where Splunk will be installed in /Applications/splunk .

To install into a directory other than /Applications/splunk on any volume, use the graphical installer as described above.

Solaris

# pkgadd splunk.pkg

Tarball

• Unpack the tarball into an appropriate directory. Be sure the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.
• Follow the instructions in the README.txt file in the top-level directory, e.g. /opt/splunk/README.txt

Step 4

If you configured multiple users in your 2.1.x Splunk install those users will not be presented after upgrading to 2.2

The users are still stored in the authentication database. This script will allow your 2.2 install to read the users in.

• Uncompress the migrate_users.py script to the Splunk 2.2 machine's $SPLUNK_HOME directory.
• Source $SPLUNK_HOME/bin/setSplunkEnv into your shell's environment.
• Execute "python migrate_users.py $SPLUNK_HOME".

Step 5

If you altered any of the configuration files verify that those changes were not overwritten. Common configuration files that can be overwritten include (but are not limited to):

• $SPLUNK_HOME/etc/myinstall/pluginConfs/multiIndexer.xml
• $SPLUNK_HOME/etc/myinstall/splunkd.xml
• $SPLUNK_HOME/etc/myinstall/search.xml
• $SPLUNK_HOME/etc/myinstall/search.user.xml

Step 6

Restart the Splunk Server.

# cd $SPLUNK_HOME/bin/splunk start

• Was this topic useful?
• Post a comment