Splunk® Data Stream Processor

Install and administer the Data Stream Processor

On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see the Upgrade the Splunk Data Stream Processor topic.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.

Upgrade the Splunk Data Stream Processor to 1.2.4

This topic describes how to upgrade the Splunk Data Stream Processor (DSP) to 1.2.4.

Before you upgrade

Before you upgrade DSP, review the known issues related to the upgrade process. Depending on what functions you have in your pipelines, you might need to do some additional steps to restore those pipelines after the upgrade is complete.

As an alternative, you can uninstall DSP and do a clean install of DSP 1.2.4. To do this, see the following topics:

The Splunk Data Stream Processor does not provide a means of downgrading to previous versions. If you need to revert to an older DSP release, uninstall the upgraded version and reinstall the version you want.

Step 1: Disable the scheduled jobs

The scheduled jobs in each Amazon CloudWatch Metrics, Amazon S3, AWS Metadata, Google Cloud Monitoring, Microsoft 365, and Microsoft Azure Monitor source connector must be disabled before you upgrade DSP. If you do not deactivate all scheduled jobs in these connectors before upgrading your DSP deployment, the Kubernetes container image name used by these connectors is not updated. See the ImagePullBackoff status shown in Kubernetes after upgrading DSP troubleshooting topic for more information.

  1. Open the DSP UI and navigate to Data Management > Connections.
  2. Deactivate the schedule for each Amazon CloudWatch Metrics, Amazon S3, AWS Metadata, Google Cloud Monitoring, Microsoft 365, and Microsoft Azure Monitor source connector.
    1. Select the connection you want to edit.
    2. Toggle the Scheduled parameter off.
    3. Save your changes

Step 2: Upgrade the Splunk Data Stream Processor

  1. Download the new Data Stream Processor tarball on one of the master nodes of your cluster.
  2. Extract the tarball. 
    tar xf <dsp-version>.tar
  3. Navigate to the extracted file. 
    cd <dsp-version>
  4. (Optional) If your environment has a small root volume (6GB or less of free space) in /tmp, your upgrade may fail when you run out of space. Choose a different directory to write temporary files to during the upgrade process. 
    export TMPDIR=/<directory-on-larger-volume>
  5. From the extracted file directory, run the upgrade script. 
    sudo ./upgrade

Upgrading can take a while, depending on the number of nodes you have in your cluster. Once upgrading is done, the following message is shown: Upgrade completed successfully followed by a bunch of garbage collection logs. Once you see those logs, you can then use the latest version of the .

Step 3: Validate the upgrade

The Splunk Data Stream Processor upgrade is now complete. Any pipelines that were active before the upgrade are reactivated. When the upgrade is completed, DSP shows the following message: DSP startup completed.

  1. In the browser you use to access the DSP UI, clear the browser cache.
  2. Log in to DSP to confirm that your upgrade was successful. 
    https://<DSP_HOST>:30000/

User: dsp-admin
Password: <the dsp-admin password>

After upgrading

Perform the following steps after upgrading the Splunk Data Stream Processor.

  1. (Optional) On each node, delete the directories containing the old version of the Splunk Data Stream Processor. 
    rm -r <dsp-version-upgraded-from>
  2. Re-enable the schedules for the Amazon CloudWatch Metrics, Amazon S3, AWS Metadata, Google Cloud Monitoring, Microsoft 365, and Microsoft Azure Monitor connectors that were disabled in Step 2.
  3. If you have the Splunk App for DSP installed on your Splunk DSP cluster, you must upgrade it to the latest version. See Install the Splunk App for DSP for more information.
  4. There are some known issues that can occur when upgrading. Review the Known issues for DSP topic, and follow any workarounds that apply to you.

After upgrading to the latest version of the Splunk Data Stream Processor, any command-line operations must be performed in the new upgraded directory on the master node.

Last modified on 25 March, 2022
Install the Splunk Data Stream Processor   Uninstall the Splunk Data Stream Processor

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.4

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters