Upgrade from a previous version of the Content Pack for ITSI Monitoring and Alerting to v2.0.3

If you have lower version of the content pack installed, you can upgrade to version 2.0.3. Version 2.0.3 contains non-passive changes. Upgrading will require downtime for content pack functionality. During upgrade, you won't receive notable events and episodes for your services and KPIs.

Review the high-level upgrade steps before you begin.

1. Make note of all enabled or customized content pack objects.
2. Clone customized ITSI objects.
3. Backup custom changes of Splunk knowledge objects.
4. Disable the Add-on for the Content Pack for Monitoring and Alerting (Package name: SA-ITSI-CP-MA).
5. Upgrade to version 2.0.3 of the content pack.
6. Manually review and reapply prior customizations to the upgraded content pack objects.
7. Add the files in the upgraded content pack.
8. Manually reenable the appropriate content pack objects.
9. Remove the Add-on for the Content Pack for Monitoring and Alerting (Package name: SA-ITSI-CP-MA).

Prerequisites

Create a full backup of your ITSI environment in case you need to revert the upgraded version later. For more information, see Create a full backup in the Administer Splunk IT Service Intelligence Manual.

Make note of all enabled or customized content pack objects

Because the replace existing upgrade option on the content pack installation page both overwrites and disables any objects from the content pack, you need to identify all enabled and customized components before you upgrade. In the following upgrade steps, you will refer back to this list of objects for further action. See Release notes for the Content Pack for ITSI Monitoring and Alerting to review the ITSI objects in the content pack.

(Optional) Clone customized objects from the existing content pack

Clone customized objects from the existing content pack to save the customized object under a new name, which ensures that your changes aren't lost during the upgrade. Keep the cloned objects disabled. They exist only to allow you to perform a manual review of the updated content pack objects with your customizations to determine what changes to reapply after the upgrade.

Create a backup of custom changes to Splunk knowledge objects

Splunk Cloud Platform customers have to create a ticket to request a backup of customized knowledge objects. To file a ticket on the Splunk Support Portal, see Support and Services.

Create a backup of the local directory and metadata/local.meta in the Add-on for the Content Pack for Monitoring and Alerting (SA-ITSI-CP-MA). You will use this later to reapply your customizations.

Disable the Add-on for the Content Pack for Monitoring and Alerting

If you are a Splunk Cloud Platform customer and have the Add-on for the Content Pack for Monitoring and Alerting in a search head cluster environment, create a ticket to have the supporting add-on disabled. To file a ticket on the Splunk Support Portal, see Support and Services.

In the Content Pack for Monitoring and Alerting v2.0.3 all knowledge objects from the supporting add-on have been added to content pack. So, the dependency of the Add-on for the Content Pack for Monitoring and Alerting has been removed. To disable the Add-on for the Content Pack for Monitoring and Alerting follow these steps:

1. Select the Manage Apps gear icon.
2. Locate the Add-on for the Content Pack for Monitoring and Alerting in the list of apps.
3. Select Disable in the Status column.

Upgrade the content pack

Download and extract the latest version of Splunk App for Content Packs into the $SPLUNK_HOME/etc/apps directory to get the latest version of content pack. See Install the content pack.

Reapply prior customizations to the upgraded content pack objects

Based on the prior customizations to the content pack objects that you identified before you began the upgrade process, you might need to reapply those customizations to the upgraded objects. Review customizations in the cloned objects, as well as the release notes to reapply necessary customizations. When you are satisfied that prior customizations are appropriately integrated into the latest version of the content pack objects, you can remove any cloned objects.

Add the backup files to the upgraded content pack

Splunk Cloud Platform customers need create a support ticket to request to have backup files added to the upgraded content pack. To file a ticket on the Splunk Support Portal, see Support and Services.

Copy the files that you have backed up and move them to the content pack directory. Files in local directory of the SA-ITSI-CP-MA package need to be copied to $SPLUNK_HOME/etc/apps/DA-ITSI-CP-monitoring-alerting/local directory. Similarly, the local.meta file from the SA-ITSI-CP-MA/metadata directory needs to be copied to the $SPLUNK_HOME/etc/apps/DA-ITSI-CP-monitoring-alerting/metadata directory.

Enable previously active content pack objects

After the upgrade, all previously-enabled content pack objects are disabled. You have to enable the correct objects again to restore content pack functionality. Based on the content pack objects that were enabled before the upgrade, as well as any new functionality you want to begin using with the upgraded content pack version, evaluate and enable the appropriate objects.

Remove the Add-on for the Content Pack for Monitoring and Alerting

Splunk Cloud Platform customers need create a support ticket to request to request to have the Add-on for the Content Pack for Monitoring and Alerting removed. To file a ticket on the Splunk Support Portal, see Support and Services.

After performing the above steps, verify that all your customizations are working as expected. Once you are satisfied with the new version of content pack, remove the Add-on for the Content Pack for Monitoring and Alerting from your Splunk environment. See Uninstall an app or add-on in the Splunk Enterprise Admin Manual.