Splunk® Supported Add-ons

Splunk Add-on for VMware

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Upgrade the Splunk Add-on for VMware from v4.0.2 to v4.0.3

These steps cover upgrading from Splunk Add-on for VMware v4.0.2 to v4.0.3 only. If you are using a version previous to v4.0.2, follow the steps to upgrade to the Splunk Add-on for VMware 4.0.2. You can then follow these steps to upgrade to v4.0.3.

Step 1: Upgrade the scheduler

  1. Stop the scheduler. You can stop the scheduler on the Collection Configuration page of your scheduler machine.
  2. Stop Splunk on the scheduler instance.
  3. Download the Splunk Add-on for VMware from Splunkbase.
  4. Extract the components of Splunk Add-on for VMware to the $SPLUNK_HOME/etc/apps directory. Extracting the package contents overwrites the Splunk_TA_vmware and SA-Hydra components.

Step 2: Upgrade the forwarder data collection node

  1. Stop Splunk on the data collection node machine.
  2. Download these add-ons from Splunkbase:
  3. Extract the package components to the $SPLUNK_HOME/etc/apps directory. Extracting the package components overwrites Splunk_TA_vmware, SA-Hydra, Splunk_TA_vcenter, and Splunk_TA_esxilogs packages.

* Only download if you are directly forwarding the logs to the data collection node.

Step 3: Upgrade the indexer

  1. Enable maintenance mode on the cluster master node for the indexer cluster or stop Splunk on the indexer machine for non-cluster indexers.
  2. Download these packages from Splunkbase:
  3. Extract the package components:
    • For clustered indexer deployment, extract the package components to the $SPLUNK_HOME/etc/master-apps directory on the cluster master node and push configuration bundle from cluster master node.
    • For non-clustered indexer deployment, extract the package components to the $SPLUNK_HOME/etc/apps directory on each indexer node.

Step 4: Upgrade the search head

  1. If you are using non-clustered search heads, stop Splunk on the search head.
  2. Download these packages from Splunkbase:
  3. Extract the package components:
    • For clustered search head deployment, extract the components from the packages to the $SPLUNK_HOME/etc/shcluster/apps directory on the deployer node and push the bundle from the deployer. The deployer restarts all the search head cluster members after the upgrade is applied. If the deployer doesn't restart the search head cluster members, perform a rolling restart.
    • For non-clustered search heads, extract the components from the packages to the $SPLUNK_HOME/etc/apps directory on each search head node.

Step 5: Upgrade the dedicated ESXi log forwarder

  1. Stop Splunk on the dedicated log forwarder instance.
  2. Download the Splunk Add-on for VMware ESXi Logs from the Splunkbase.
  3. Extract the package components to the $SPLUNK_HOME/etc/apps directory.

Step 6: Upgrade the dedicated vCenter log forwarder

  1. Stop Splunk on the dedicated log forwarder instance.
  2. Download the Splunk Add-on for vCenter Logs from the Splunkbase.
  3. Extract the package components to the $SPLUNK_HOME/etc/apps directory.

Step 7: Start Splunk and data collection

  1. Start Splunk on all the respective nodes (data collection node, scheduler, forwarders).
  2. Navigate to the Collection Configuration page of the Splunk Add-on for VMware on your scheduler.
  3. Click Start Scheduler to start data collection.
Last modified on 21 July, 2021
PREVIOUS
Upgrade to the Splunk Add-on for VMware 4.0.2
  NEXT
Upgrade the Splunk Add-on for VMware from v3.4.5 to v4.0.0

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters