Upgrade from Splunk Add-on for VMware version 3.4.7 to Splunk Add-on for VMware Metrics version 4.0.0

To upgrade to the Splunk Add-on for VMware Metrics from the events-based VMware add-on, you can either use an upgrade script or perform the upgrade manually.

Upgrade the Scheduler and DCN using an upgrade script

Perform the following steps to upgrade to Splunk Add-on for VMware Metrics from Splunk Add-on for VMware using an upgrade script.

Upgrade your DCS

1. Get the upgrade_script_event_TA.py script from the Splunk Support team and put it on the scheduler machine of Splunk Add-on for VMware.
2. Remove the splunk_vmware_admin or splunk_vmware_user roles from the Splunk user, if these roles are assigned to any Splunk user.
3. Stop the scheduler:
   1. Go to Collection Configuration page of Splunk Add-on for VMware.
   2. Click Stop Scheduler.
   3. Stop the Splunk instance of the scheduler.
4. Extract the contents of the Splunk Add-on for VMware Metrics package to the $SPLUNK_HOME/etc/apps directory.
5. Go to $SPLUNK_HOME/etc/apps and delete the following packages:
   • Splunk_TA_vcenter
   • Splunk_TA_esxilogs
   • SA-VMWIndex-inframon
6. Run the upgrade script using Python. Use the following command to run the script:
   $SPLUNK_HOME/bin/splunk cmd python upgrade_script_event_TA.py
   When prompted to select the component on which the script is running, choose Scheduler. You'll see a message saying that the scheduler was successfully upgraded to the latest metrics TA. In case of errors, refer to the upgrade_event_TA_to_new_metric_TA.log file present in $SPLUNK_HOME/var/log/splunk directory.

Upgrade your DCN

1. Get the upgrade_script_event_TA.py script from the Splunk Support team and put it on the DCN machine of Splunk Add-on for VMware.
2. Remove the splunk_vmware_admin or splunk_vmware_user roles if these roles are assigned to the any Splunk user.
3. Stop the Splunk instance of the DCN.
4. Extract the contents of the Splunk Add-on for VMware Metrics package to the $SPLUNK_HOME/etc/apps directory. Extracting the TA package to etc/apps might overwrite the Splunk_TA_esxilogs and Splunk_TA_vcenter packages, if the packages are present in the etc/apps directory.
5. Go to, $SPLUNK_HOME/etc/apps and delete the following packages:
   • SA-VMWIndex-inframon
   • Splunk_TA_vcenter (if forwarding vCenter logs directly to the indexer)
   • Splunk_TA_esxilogs (if forwarding ESXi logs directly to the indexer)
6. Run the upgrade script using Python. Use the following command to run the script:
   $SPLUNK_HOME/bin/splunk cmd python upgrade_script_event_TA.py
7. When prompted to select the component on which the script is running, choose DCN. You'll see a message when the DCN is upgraded successfully. In case of errors, refer to the upgrade_event_TA_to_new_metric_TA.log file present in the $SPLUNK_HOME/var/log/splunk directory.

Upgrade indexers

1. Stop all indexer instances.
2. Extract the contents of the Splunk Add-on for VMware Metrics to the $SPLUNK_HOME/etc/apps directory. Extracting the add-on package to etc/apps might overwrite Splunk_TA_esxilogs and Splunk_TA_vcenter packages if the packages are present in the etc/apps directory.
3. Go to $SPLUNK_HOME/etc/apps/ and delete the following directories:
   • Splunk_TA_vmware_inframon
   • SA-Hydra-inframon
   • Splunk_TA_vcenter (If forwarding VC logs to the DCN)
   • Splunk_TA_esxilogs (If forwarding ESXi logs to the DCN)
4. If you want to see the historical data in the Splunk Add-on for VMware Metrics, then put the below stanzas in SA-VMWIndex-inframon/local/indexes.conf file:

   [vmware-perf]
   homePath = $SPLUNK_DB/vmware-perf/db
   coldPath = $SPLUNK_DB/VMware-perf/colddb
   thawedPath = $SPLUNK_DB/vmware-perf/thaweddb
   repFactor = auto

5. Take a backup of the SA-VMWIndex directory to the directory other than $SPLUNK_HOME/etc/apps, then remove them from $SPLUNK_HOME/etc/apps.

Upgrade your search head

1. Stop the search head instance.
2. After you upgrade to Splunk Add-on for VMware Metrics, you will no longer see the new data in Splunk Add-on for VMware. You must use the latest version of SAI. You can remove the VMware app components from etc/Apps, if you would like:
   • TA-VMW-FieldExtractions
   • SA-Threshold
   • SA-VMW-HierarchyInventory
   • SA-VMW-LogEventTask
   • splunk_for_vmware
   • SA-VMNetAppUtils

Start Splunk

1. Start Splunk on the DCN, Scheduler, indexer and search head instances after upgrading them.
2. Start the Scheduler from the Collection Configuration page of Splunk Add-on for VMware Metrics on the Scheduler machine.

Manually upgrade the Scheduler and DCN

Perform below steps to manually upgrade to Splunk Add-on for VMware Metrics from events-based version of the Splunk Add-on for VMware.

Upgrade your DCS

1. On scheduler machine, go to the Collection Configuration page and click Stop Scheduler.
2. Remove the splunk_vmware_admin or splunk_vmware_user roles from the Splunk user, if these roles are assigned to any Splunk user.
3. Stop the Splunk instance of the scheduler.
4. Extract the contents of the Splunk Add-on for VMware Metrics to the $SPLUNK_HOME/etc/apps directory.
5. Go to $SPLUNK_HOME/etc/apps/ and delete the following directories:
   • SA-VMWIndex-inframon
   • Splunk_TA_vcenter
   • Splunk_TA_esxilogs
6. Copy the following files from the Splunk_TA_vmware/local package to Splunk_TA_vmware_inframon/local:
   • password.conf
   • hydra_node.conf
   • ta_vmware_collection.conf
   • ta_vmware_config_ssl.conf
7. Rename the following files:

   Old name	New name
   hydra_node.conf	inframon_hydra_node.conf
   ta_vmware_collection.conf	inframon_ta_vmware_collection.conf
   ta_vmware_config_ssl.conf	inframon_ta_vmware_config_ssl.conf

8. Add pool_name = Global pool under all stanzas into Splunk_TA_vmware_inframon/local/inframon_hydra_node.conf and Splunk_TA_vmware/local/inframon_ta_vmware_collection.conf except in the [default] stanza. For example:

   [stanza_name]
   addon_validation = 1
   credential_validation = 1
   heads = 1
   host = <stanza_name>
   user = admin
   pool_name = Global pool

9. Remove the following parameters from the default stanza of Splunk_TA_vmware_inframon/local/inframon_ta_vmware_collection.conf file, if present:
   • host_metric_whitelist
   • host_metric_blacklist
   • vm_metric_whitelist
   • vm_metric_blacklist
   • rp_metric_whitelist
   • rp_metric_blacklist
   • cluster_metric_whitelist
   • cluster_metric_blacklist
   • rp_instance_whitelist
   • rp_instance_blacklist
10. Move the configurations from Splunk_TA_vmware_inframon/local/inframon_ta_vmware_collection.conf to Splunk_TA_vmware_inframon/local/inframon_ta_vmware_pool.conf:
    1. Create the file local/inframon_ta_vmware_pool.conf with the stanza [Global pool].
    2. Move task, <task>_interval, <task>_expiration and atomic_tasks parameters from the [default] stanza of inframon_ta_vmware_collection.conf to the [Global pool] stanza of local/inframon_ta_vmware_pool.conf.
    3. After moving configurations to local/inframon_ta_vmware_pool.conf, replace the word otherperf with clusterperf, if any.
    4. Remove hierarchyinv and rpinv from the task parameter, if present.
11. Copy the configurations file contents from SA-Hydra/local to the corresponding file into SA-Hydra-inframon/local.
12. Rename the following files, if present:

    Old name	New name
    hydra_gateway.conf	inframon_hydra_gateway.conf
    hydra_node.conf	inframon_hydra_node.conf

13. Take a backup of the Splunk_TA_vmware and SA-Hydra directories to a directory other than $SPLUNK_HOME/etc/apps, then remove them from $SPLUNK_HOME/etc/apps.

Upgrade your DCN

1. Remove the splunk_vmware_admin or splunk_vmware_user roles from the Splunk user, if these roles are assigned to the any Splunk user.
2. Stop Splunk on the DCN instance.
3. Extract the contents of the Splunk Add-on for VMware Metrics to the $SPLUNK_HOME/etc/apps directory. Extracting the package to etc/apps might overwrite Splunk_TA_esxilogs and Splunk_TA_vcenter packages, if the packages are present in the etc/apps directory.
4. Go to $SPLUNK_HOME/etc/apps/ and delete the following directories:
   • SA-VMWIndex-inframon
   • Splunk_TA_vcenter (If forwarding vcenter logs directly to the indexer)
   • Splunk_TA_esxilogs (If forwarding ESXi logs directly to the Indexer)
5. Copy the hydra_gateway.conf file from SA-Hydra/local to SA-Hydra-inframon/local, if present. Rename the hydra_gateway.conf file to inframon_hydra_gateway.conf.
6. Take a backup of the following directories to the directory other than $SPLUNK_HOME/etc/apps, then remove them from $SPLUNK_HOME/etc/apps:
   • Splunk_TA_vmware
   • SA-Hydra

Upgrade indexers

1. Stop all indexer instances.
2. Extract the contents of the Splunk Add-on for VMware Metrics to the $SPLUNK_HOME/etc/apps directory. Extracting the add-on package to etc/apps might overwrite Splunk_TA_esxilogs and Splunk_TA_vcenter packages if the packages are present in the etc/apps directory.
3. Go to $SPLUNK_HOME/etc/apps/ and delete the following directories:
   • Splunk_TA_vmware_inframon
   • SA-Hydra-inframon
   • Splunk_TA_vcenter (If forwarding VC logs to the DCN)
   • Splunk_TA_esxilogs (If forwarding ESXi logs to the DCN)
4. If you want to see the historical data in the Splunk Add-on for VMware Metrics, then put the below stanzas in SA-VMWIndex-inframon/local/indexes.conf file:

   [vmware-perf]
   homePath = $SPLUNK_DB/vmware-perf/db
   coldPath = $SPLUNK_DB/VMware-perf/colddb
   thawedPath = $SPLUNK_DB/vmware-perf/thaweddb
   repFactor = auto

5. Take a backup of the SA-VMWIndex directory to the directory other than $SPLUNK_HOME/etc/apps, then remove them from $SPLUNK_HOME/etc/apps.

Upgrade your search head

1. Stop the search head instance.
2. After you upgrade to Splunk Add-on for VMware Metrics, you will no longer see the new data in Splunk Add-on for VMware. You must use the latest version of SAI. You can remove the VMware app components from etc/Apps, if you would like:
   • TA-VMW-FieldExtractions
   • SA-Threshold
   • SA-VMW-HierarchyInventory
   • SA-VMW-LogEventTask
   • splunk_for_vmware
   • SA-VMNetAppUtils

Start Splunk

1. Start Splunk on the DCN, Scheduler, indexer and search head instances after upgrading them.
2. Start the Scheduler from the Collection Configuration page of Splunk Add-on for VMware Metrics on the Scheduler machine.