Upgrade the Splunk App for AWS

When you upgrade from a previous version to the 5.0.1 version of the Splunk App for AWS, be aware of the following changes.

• This version of the app requires Splunk Add-on for AWS 4.1.2 or later.
• The new inputs in this version of the app require additional setup and IAM permissions in the AWS Management Console.
• The Topology and EC2 Insights, and Insights Overview dashboards require the use of the Python for Scientific Computing libraries to be fully functional.
• This version of the app requires you to manually set a Region Category for all new AWS accounts: Global, GovCloud, or China. If you are using legacy accounts that do not already have a region category set or detected, the app displays an "invalid account detected" message on your Configure page. Edit these accounts by clicking their friendly name in the Accounts listing and selecting the appropriate region category. Until you adjust the accounts, any inputs that use the account cease collecting data until the Region Category is correctly set.
• This version of the app introduces a new aws_admin role that lets you grant non-admin users permissions to configure the Splunk App for AWS. To take advantage of this new feature, you need to set up access control in the Splunk App for AWS.

Upgrade from version 5.0.0 to 5.0.1

Perform an in-place upgrade, no additional configuration steps required.

Upgrade from version 4.1.0 to 5.0.1

Perform an in-place upgrade. If you use a non-clustered distributed Spunk deployment, you do not need to perform any additional upgrade activity. If you use a clustered distributed Splunk deployment, you need to perform some additional steps:

• Configure the search head tier to directly forward data to the indexer tier.
• Distribute the summary index configuration bundle across clustered indexers.

For detailed instructions, see Install in a clustered distributed environment.

Upgrade from version 4.0.0 to 5.0.1

You need to upgrade from version 4.0.0 to 4.1.0 first, then from 4.1.0 to 5.0.1. See Upgrade guide for the Splunk App for AWS in the 4.1.0 version of the documentation for upgrade steps and new behavior to be aware of.

Upgrade from a pre-4.X version to 5.0.1

If you are upgrading from a pre-4.X version of the app, install the version as a new app. Starting from version 4.X, the app has a new folder name, so it does not replace 3.X or older versions in your environment. See Migrate from an unsupported version of the Splunk App for AWS in the version 4.0.0 documentation.