Upgrade the Data Stream Processor
If the Splunk Data Stream Processor was previously installed and configured, do the following to upgrade your software. Review these two known issues before upgrading:
An upgrade to DSP 1.1.0 changes the message bus from Apache Kafka to Apache Pulsar. Data sent before and during the upgrade is lost in the switchover. You may continue sending data during the upgrade, but only data ingested after the upgrade finishes will be sent through DSP.
If you are currently using DSP 1.0.0, you cannot directly upgrade to DSP 1.1.0. You must first upgrade DSP 1.0.0 to DSP 1.0.1, and then upgrade again to DSP 1.1.0.
Steps
- Download the new Data Stream Processor tarball on the master node of your cluster.
- Extract the tarball.
tar xf <dsp-version>.tar
- (Optional) copy and extract the tarball on each DSP node in your cluster. This lets you make changes on each node if required during the upgrade process even if the master node is down or unavailable.
- Navigate to the extracted file on your master node.
cd <dsp-version>
- (Optional) If your environment has a small root volume (6GB or less of free space) in
/tmp
, your upgrade may fail when you run out of space. Choose a different directory to write temporary files to during the upgrade process.export TMPDIR=/<directory-on-larger-volume>
- From the extracted file directory, run the upgrade script.
./upgrade
- Upgrading can take a while. Upon completion, the following message is shown.
Waiting for DSP to startup .................... DSP startup completed
- (Optional) While waiting for the upgrade to complete, you can use the following command to monitor the progress of your upgrade. Run this command after you see the
Waiting for DSP to startup
message.kubectl get pods -n dsp
When the following services have statusRUNNING
, then the upgrade is complete:dsp
,ingest-hec
,ingest-s2s
,splunk-streaming-rest
,usr-mgmt-svc
.
Install the Data Stream Processor | Uninstall the Splunk Data Stream Processor |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0
Feedback submitted, thanks!