Upgrade to version 1.2.0 of the Content Pack for Monitoring Windows

Starting from Splunk App for Content Packs 1.5.0, all the necessary macros are packaged with the content pack. If you are migrating from a lower version, you will need to delete the manually created macro itsi-cp-windows-indexes to avoid knowledge object conflicts.

The steps below describe how to upgrade to version 1.2.0 of the content pack:

1. Remove the manually created macro
2. Upgrade the Splunk App for Content Packs.
3. Upgrade the Content Pack for Monitoring Microsoft Windows.
4. Update index macros with custom index.
5. Update KPI Base Search macros based on data ingestion method

Prerequisites

Create a full backup of your ITSI environment in case you need to revert the upgrade. For more information, see Create a Full Backup in the Administer Splunk IT Service Intelligence manual.

Step 1: Remove manually created macro

If you are upgrading from Splunk App for Content Packs 1.4.0 or earlier, then you would have a manually created macro itsi-cp-windows-indexes. Starting from Splunk App for Content Packs 1.5.0, this macro is packaged with the content pack. Delete the manually created macro to avoid knowledge object conflicts.

Step 2: Upgrade the Splunk App for Content Packs

Check which version of Splunk App for Content Packs is compatible with your ITSI version in the deployment requirements.

Download version 1.8.0 of the Splunk App for Content Packs from Splunkbase.

Follow the installation steps to upgrade the Splunk App for Content Packs.

Restart Splunk.

Step 3. Upgrade the Content Pack for Monitoring Microsoft Windows

Follow these steps to re-install the content pack. Make sure to select the Replace Existing parameter while reinstalling the installed ITSI objects to incorporate the new updates.

Step 4. (Optional) Update Macros with custom index

Follow these steps to update the macros.