Upgrade from Splunk VMware Add-on for ITSI version 1.1.1 to Splunk Add-on for VMware Metrics version 4.0.0

From Splunk App for Infrastructure (SAI) versions 2.0.0 - 2.1.0, all components you needed to deploy VMware data collection for SAI were shipped in the ITSI installation package within the vmware_ta_itsi parent directory. The add-on was removed from the ITSI package in version 4.6.0. If you've already deployed VMware data collection using the vmware_ta_itsi add-on, perform the following steps to upgrade to the Splunk Add-on for VMware Metrics.

To upgrade to the Splunk Add-on for VMware Metrics from the vmware_ta_itsi add-on, you can either use an upgrade script or perform the upgrade manually.

Upgrade the Scheduler and DCN using an upgrade script

Perform the following steps to upgrade the Splunk VMware Add-on for ITSI to the Splunk Add-on for VMware Metrics using an upgrade script.

Upgrade your DCS

1. Download the upgrade_script_metric_TA.py and put it on the scheduler machine of Splunk VMware Add-on for ITSI.
2. Stop the scheduler on the Splunk App for Infrastructure (SAI).
3. Stop the Splunk instance of the scheduler.
4. Extract the contents of the Splunk Add-on for VMware Metrics package to the $SPLUNK_HOME/etc/apps directory.
5. Go to $SPLUNK_HOME/etc/apps and delete the following packages:
   • Splunk_TA_vcenter
   • Splunk_TA_esxilogs
   • SA-VMWIndex-inframon
6. Run the upgrade script using the following command:
   $SPLUNK_HOME/bin/splunk cmd python upgrade_script_metric_TA.py
7. When you're prompted to select the component on which the script is running, choose Scheduler. You'll see a message when the scheduler is upgraded successfully. In case of errors, refer to the upgrade_metric_TA_to_new_metric_TA.log file in the $SPLUNK_HOME/var/log/splunk directory.

Upgrade your DCN

1. Download the upgrade_script_metric_TA.py script and put it on the DCN machine of Splunk VMware Add-on for ITSI.
2. Stop the Splunk instance of the DCN.
3. Extract the contents of the Splunk Add-on for VMware Metrics package to the $SPLUNK_HOME/etc/apps directory. Extracting the metrics TA package to etc/apps might overwrite Splunk_TA_esxilogs and Splunk_TA_vcenter packages if the packages are present in the etc/apps directory.
4. Go to $SPLUNK_HOME/etc/apps and delete the following packages:
   • SA-VMWIndex-inframon
   • Splunk_TA_vcenter (if forwarding vCenter logs directly to the indexer)
   • Splunk_TA_esxilogs (if forwarding ESXi logs directly to the indexer)
5. Run the upgrade script using the following command:
   $SPLUNK_HOME/bin/splunk cmd python upgrade_script_metric_TA.py
6. When prompted to select the component on which the script is running, choose DCN. You'll see a confirmation message when the DCN is upgraded successfully. In case of errors, refer to the upgrade_metric_TA_to_new_metric_TA.log file in the $SPLUNK_HOME/var/log/splunk directory.

Upgrade your indexer

1. Stop the indexer.
2. Extract the contents of the new Splunk Add-on for VMware Metrics to the $SPLUNK_HOME/etc/apps directory. Extracting might overwrite the Splunk_TA_esxilogs and Splunk_TA_vcenter packages if the packages are present in the etc/apps directory.
3. Go to $SPLUNK_HOME/etc/apps and delete the following packages:
   • Splunk_TA_vmware_inframon
   • SA-Hydra-inframon
   • Splunk_TA_vcenter (if forwarding vCenter logs directly to the DCN)
   • Splunk_TA_esxilogs (if forwarding ESXi logs directly to the DCN)
4. Take a backup of the SA-VMWIndex package and remove it from $SPLUNK_HOME/etc/apps.

Start Splunk

1. Start Splunk on the DCN, Scheduler and indexer instances after upgrading them.
2. Start the Scheduler from the Collection Configuration page of Splunk Add-on for VMware Metrics on the Scheduler machine.

Manually upgrade the Scheduler and DCN

Perform the following steps to manually upgrade the Splunk VMware Add-on for ITSI to the Splunk Add-on for VMware Metrics.

Upgrade your DCS

1. Stop the scheduler from the Splunk App for Infrastructure (SAI).
2. Stop your Splunk instance.
3. Extract the contents of the Splunk Add-on for VMware Metrics to the $SPLUNK_HOME/etc/apps directory.
4. Go to $SPLUNK_HOME/etc/apps and delete the following packages:
   • Splunk_TA_vcenter
   • Splunk_TA_esxilogs
   • SA-VMWIndex-inframon
5. Copy the following files from the Splunk_TA_vmware/local package to Splunk_TA_vmware_inframon/local:
   • pool.conf
   • template.conf
   • passwords.conf
   • hydra_node.conf
   • ta_vmware_collection.conf
   • ta_vmware_config_ssl.conf
6. Rename the following files:

   Old name	New name
   pool.conf	inframon_ta_vmware_pool.conf
   template.conf	inframon_ta_vmware_template.conf
   hydra_node.conf	inframon_hydra_node.conf
   ta_vmware_collection.conf	inframon_ta_vmware_collection.conf
   ta_vmware_config_ssl.conf	inframon_ta_vmware_config_ssl.conf

7. Copy the hydra_gateway.conf file which is present in the SA-Hydra/local to SA-Hydra-inframon/local directory. Remove the run folder from SA-Hydra-inframon/local, if present.
8. Take a backup of the following packages and remove them from $SPLUNK_HOME/etc/apps:
   • Splunk_TA_vmware
   • SA-Hydra

Upgrade DCN

1. Stop the DCN instance.
2. Extract the content of the new Metric TA to the $SPLUNK_HOME/etc/apps directory. Extracting the Metric TA package to etc/apps may overwrite Splunk_TA_esxilogs and Splunk_TA_vcenter packages, if the packages are present in the etc/apps directory.
3. Go to $SPLUNK_HOME/etc/apps and delete the following packages:
   • SA-VMWIndex-inframon
   • Splunk_TA_vcenter (if forwarding vCenter logs, directly to the Indexer)
   • Splunk_TA_esxilogs (if forwarding ESXi logs, directly to the Indexer)
4. Copy the hydra_gateway.conf file from SA-Hydra/local to SA-Hydra-inframon/local, if present. Rename the hydra_gateway.conf file as inframon_hydra_gateway.conf.
5. Take a backup of below packages and remove them from $SPLUNK_HOME/etc/apps:
   • Splunk_TA_vmware
   • SA-Hydra

Upgrade your indexer

1. Stop the indexer.
2. Extract the contents of the new Splunk Add-on for VMware Metrics to the $SPLUNK_HOME/etc/apps directory. Extracting might overwrite the Splunk_TA_esxilogs and Splunk_TA_vcenter packages if the packages are present in the etc/apps directory.
3. Go to $SPLUNK_HOME/etc/apps and delete the following packages:
   • Splunk_TA_vmware_inframon
   • SA-Hydra-inframon
   • Splunk_TA_vcenter (if forwarding vCenter logs directly to the DCN)
   • Splunk_TA_esxilogs (if forwarding ESXi logs directly to the DCN)
4. Take a backup of the SA-VMWIndex package and remove it from $SPLUNK_HOME/etc/apps.

Start Splunk

1. Start Splunk on the DCN, Scheduler and indexer instances after upgrading them.
2. Start the Scheduler from the Collection Configuration page of Splunk Add-on for VMware Metrics on the Scheduler machine.