Upgrade the Splunk Add-on for VMware from v3.4.5 to v4.0.0

These steps cover upgrading from Splunk Add-on for VMware from version 3.4.5 to version 4.0.0.

Upgrade your scheduler to v4.0.0

Follow these steps on the scheduler machine.

1. Stop your scheduler by selecting Stop Scheduler from the Collection Configuration page of the add-on.
2. Stop Splunk.
3. Overwrite splunk_TA_vmware and SA-Hydra packages with new versions packaged in Splunk Add-on for VMware v4.0.0 build.
4. Delete these other apps: SA-VMNetAppUtils, SA-VMWIndex, and TA-VMW-FieldExtractions.
5. Remove suds directory, uuid.py and uuid.pyc files from the Splunk_TA_vmware/bin/ directory.
6. Remove uuid.py and uuid.pyc files from the SA-Hydra/bin/hydra/ directory.
7. (Optional) Remove SA-Hydra/appserver directory.

Upgrade your data collection node

Follow these steps on the data collection node (DCN) machine.

1. Stop Splunk.
2. Overwrite versions of Splunk_TA_vmware, Splunk_TA_esxilogs, Splunk_TA_vcenter and SA-Hydra packages on each data collection node with 4.0.0 versions. #Delete these other apps: SA-VMNetAppUtils, SA-VMWIndex, and TA-VMW-FieldExtractions.
3. Remove suds directory, uuid.py, and uuid.pyc files from the Splunk_TA_vmware/bin/ directory.
4. Remove uuid.py and uuid.pyc files from the SA-Hydra/bin/hydra/ directory.
5. (Optional) Remove SA-Hydra/appserver directory.

Upgrade the Indexer

Follow these steps on the indexer machine.

1. Enable maintenance mode on the cluster master node for the indexer cluster or stop Splunk on the indexer machine for non-cluster indexers.
2. Remove SA-Hydra, SA-VMNetAppUtils, Splunk_TA_vmware, and TA-VMW-FieldExtractions directories, if present.
3. If you aren't forwarding the data from forwarder then download the Splunk Add-on for VMWare version 4.0.0 from Splunkbase and extract these packages:
   • Splunk_TA_vcenter
   • Splunk_TA_esxilogs
   • SA-VMWIndex
4. Extract the package components according to your deployment type:
   • For clustered indexer deployment, extract the package components to the $SPLUNK_HOME/etc/master-apps directory on the cluster master node and push configuration bundle from cluster master node.
   • For non-clustered indexer deployment, extract the package components to the $SPLUNK_HOME/etc/apps directory on each indexer node.

Upgrade the search head

Follow these steps on the search head machine.

1. If you are using non-clustered search heads, stop Splunk on the search head.
2. (Optional) Remove the SA-Hydra/appserver/ directory, if present.
3. Download the Splunk Add-on for VMWare version 4.0.0 from Splunkbase and extract these packages:
   • Splunk_TA_esxilogs
   • Splunk_TA_vcenter
   • TA-VMW-FieldExtractions
4. Extract the package components according go your deployment type:
   • For clustered search head deployment, extract the components from the packages to the $SPLUNK_HOME/etc/shcluster/apps directory on the deployer node and push the bundle from the deployer. The deployer restarts all the search head cluster members after the upgrade is applied. If the deployer doesn't restart the search head cluster members, perform a rolling restart.
   • For non-clustered search heads, extract the components from the packages to the $SPLUNK_HOME/etc/apps directory on each search head node.

Upgrade the dedicated ESXi log forwarder

Follow these steps on the dedicated ESXi log forwarder machine.

1. Stop Splunk on the dedicated log forwarder instance.
2. Download the Splunk Add-on for VMWare version 4.0.0 from Splunkbase.
3. Extract the Splunk_TA_esxilogs package components to the $SPLUNK_HOME/etc/apps directory.

Upgrade the dedicated vCenter log forwarder

Follow these steps on the dedicated vCenter log forwarder machine.

1. Stop Splunk on the dedicated log forwarder instance.
2. Download the Splunk Add-on for VMWare version 4.0.0 from Splunkbase.
3. Extract the Splunk_TA_vcenter package components to the $SPLUNK_HOME/etc/apps directory.

Start Splunk and data collection

1. Start Splunk on all the respective nodes (data collection node, scheduler, forwarders).
2. Navigate to the Collection Configuration page of the Splunk Add-on for VMware on your scheduler.
3. Select Start Scheduler to start data collection.