Upgrading a forwarder from 2.x to 3.x

Upgrading a forwarder from 2.x to 3.x

The procedure for upgrading a Splunk forwarder from 2.x to 3.x is identical to that of any Splunk install, with a few additional steps.

Note: This procedure assumes you have set the $SPLUNK_HOME environment variable. To do this, execute the following command (where pathtoSplunk = the path to your Splunk install).

• source pathtoSplunk/bin/setSplunkEnv

To upgrade a forwarder from 2.x to 3.x

1. Follow the procedures for upgrading Splunk 2.x to 3.x.

1. Patch splunkd.xml.

# Go to the directory containing splunkd.xml.  

• • cd $SPLUNK_HOME/etc/myinstall

# Apply the patch for forwarders to splunkd.xml.

• • patch -p0 < /path/to/splunkd.xml-2.x-3.x-forwarder.patch

1. Convert config.xml to outputs.conf.

# Go to the TCP directory.

• • cd $SPLUNK_HOME/etc/modules/output/TCP.

# Execute the following command:

• • $SPLUNK_HOME/bin/splunk _internal configfix-fwd config.xml -save-to $SPLUNK_HOME/etc/bundles/local/outputs.conf

1. Rename config.xml and to config.xml.old (to have a back-up).

• • mv config.xml config.xml.old

1. If you have enabled local indexing, add the key indexAndForward=true under the [tcpout] stanza in outputs.conf. If you haven't enabled local indexing, skip this step.

1. Start Splunk.

Your upgrade is now complete.

• Was this topic useful?
• Post a comment