Upgrade the Splunk Add-on for VMware from v4.0.2 to v4.0.6

These steps cover upgrading from Splunk Add-on for VMware versions 4.0.2, 4.0.3, 4.0.4, and 4.0.5 to v4.0.6 only. If you are using a version previous to v4.0.2, follow the steps to upgrade to the Splunk Add-on for VMware 4.0.2. You can then follow these steps to upgrade to v4.0.4.

Step 1: Upgrade the scheduler

1. Stop the scheduler. You can stop the scheduler on the Collection Configuration page of your scheduler machine.
2. Stop Splunk on the scheduler instance.
3. Download the Splunk Add-on for VMware from Splunkbase.
4. Extract the components of Splunk Add-on for VMware to the $SPLUNK_HOME/etc/apps directory. Extracting the package contents overwrites the Splunk_TA_vmware and SA-Hydra components.

Step 2: Upgrade the forwarder data collection node

1. Stop Splunk on the data collection node machine.
2. Download these add-ons from Splunkbase:
   • Splunk Add-on for VMware (contains the Splunk_TA_vmware and SA-Hydra packages)
   • Splunk Add-on for vCenter Logs (contains the Splunk_TA_vcenter package)*
   • Splunk Add-on for VMware ESXi Logs (contains the Splunk_TA_esxilogs package)*
3. Extract the package components to the $SPLUNK_HOME/etc/apps directory. Extracting the package components overwrites Splunk_TA_vmware, SA-Hydra, Splunk_TA_vcenter, and Splunk_TA_esxilogs packages.

* Only download if you are directly forwarding the logs to the data collection node.

Step 3: Upgrade the indexer

1. Enable maintenance mode on the cluster master node for the indexer cluster or stop Splunk on the indexer machine for non-cluster indexers.
2. Download these packages from Splunkbase:
   • Splunk Add-on for VMware Indexes (contains the SA-VMWIndex package)
   • Splunk Add-on for vCenter Logs (contains the Splunk_TA_vcenter package)
   • Splunk Add-on for VMware ESXi Logs (contains the Splunk_TA_esxilogs package)
3. Extract the package components:
   • For clustered indexer deployment, extract the package components to the $SPLUNK_HOME/etc/master-apps directory on the cluster master node and push configuration bundle from cluster master node.
   • For non-clustered indexer deployment, extract the package components to the $SPLUNK_HOME/etc/apps directory on each indexer node.

Step 4: Upgrade the search head

1. If you are using non-clustered search heads, stop Splunk on the search head.
2. Download these packages from Splunkbase:
   • Splunk Add-on for VMware Extractions (contains the TA-VMW-FieldExtractions package)
   • Splunk Add-on for vCenter Logs (contains the Splunk_TA_vcenter package)
   • Splunk Add-on for VMware ESXi Logs (contains the Splunk_TA_esxilogs package)
3. Extract the package components:
   • For clustered search head deployment, extract the components from the packages to the $SPLUNK_HOME/etc/shcluster/apps directory on the deployer node and push the bundle from the deployer. The deployer restarts all the search head cluster members after the upgrade is applied. If the deployer doesn't restart the search head cluster members, perform a rolling restart.
   • For non-clustered search heads, extract the components from the packages to the $SPLUNK_HOME/etc/apps directory on each search head node.

Step 5: Upgrade the dedicated ESXi log forwarder

1. Stop Splunk on the dedicated log forwarder instance.
2. Download the Splunk Add-on for VMware ESXi Logs from the Splunkbase.
3. Extract the package components to the $SPLUNK_HOME/etc/apps directory.

Step 6: Upgrade the dedicated vCenter log forwarder

1. Stop Splunk on the dedicated log forwarder instance.
2. Download the Splunk Add-on for vCenter Logs from the Splunkbase.
3. Extract the package components to the $SPLUNK_HOME/etc/apps directory.

Step 7: Start Splunk and data collection

1. Start Splunk on all the respective nodes (data collection node, scheduler, forwarders).
2. Navigate to the Collection Configuration page of the Splunk Add-on for VMware on your scheduler.
3. Click Start Scheduler to start data collection.