Upgrade Splunk Enterprise Security
This topic describes how to upgrade Splunk Enterprise Security on an on-premises search head from version 4.0 or later to the latest release. Splunk Cloud customers must work with Splunk Support to coordinate upgrades to Enterprise Security.
Step 1. Review the planning topic
- For an overview of the upgrade process and prerequisites, see Planning an upgrade in this manual.
- Perform a full backup of the search head before upgrading.
To back out of the upgrade, you must restore the prior version of Splunk Enterprise Security from backup.
Step 2. Download Splunk Enterprise Security
- Open splunk.com and log in with your Splunk.com ID. You must be a licensed Enterprise Security customer to download the product.
- Download the latest Splunk Enterprise Security product.
- Choose Download and save the Splunk Enterprise Security product file to your desktop.
- Log in to the Enterprise Security search head as an administrator.
Step 3. Install the latest Splunk Enterprise Security
- On the Splunk Enterprise search page, select Apps > Manage Apps and choose Install App from File.
- Click Upgrade app to start an upgrade.
- Click Choose File and select the Splunk Enterprise Security product file.
- Click Upload to begin the installation.
- When prompted, restart Splunk Enterprise.
If you do not run the setup procedure promptly after the file upload completes, Enterprise Security displays errors.
Step 4. Set up Splunk Enterprise Security
After Splunk Web returns after the restart, set up Splunk Enterprise Security.
- Click Continue to app setup page to start the ES setup.
- Click Start.
- The Splunk Enterprise Security Post-Install Configuration page indicates the upgrade status as it moves through the stages of installation.
- Choose to exclude selected add-ons from being installed, or install and disable them.
When the setup is done, the page prompts you to restart Splunk platform services.
- Click Restart Splunk to finish the installation.
Step 5. Validate the upgrade
The Splunk Enterprise Security upgrade process is now complete. Objects disabled during the upgrade process will automatically be enabled.
- On the Enterprise Security menu bar, select Audit > ES Configuration Health.
- Review potential conflicts and changes to the default settings. See ES Configuration Health in the User Manual.
- Clear the browser cache of the browser you use to access Splunk Web to make sure that you access a fresh version of Splunk Web after upgrading. If you do not clear the browser cache, some pages might fail to load.
Splunk logs the upgrade in
Version-specific upgrade notes
After upgrading to this version, the Investigations page might no longer appear in the navigation toolbar. Because the Investigations page was renamed in 4.6.x and the navigation editor now respects local overrides, the My Investigations page is no longer visible in the navigation and the Investigations page does not replace it. To add the Investigations page to the navigation, select Config > General > Navigation and add the Investigations view to the navigation in Splunk Enterprise Security. See Customize the menu bar in Splunk Enterprise Security in Administer Splunk Enterprise Security.
After upgrading Enterprise Security from a version prior to 4.1.x to a version after 4.1.x, the correlation search editor may show configurations inconsistent with pre-upgrade settings if the search migration process is still running. Search the internal index to look for successfully migrated searches and review the status of the migration operation.
index=_internal sourcetype=configuration_check file="confcheck_es_modactions*" migrated
After upgrading Enterprise Security from a version prior to 4.1.x to a version after 4.1.x, enabled correlation searches that are not configured to create notable events revert to creating notable events. For example, a correlation search that by default created a notable event and a risk modifier that you configured to create only a risk modifier will, after upgrade, create both a risk modifier and a notable event.
- Before upgrading, note enabled correlation searches that do not create notable events using the following search.
| rest splunk_server=local count=0 /services/saved/searches search="name=\"*-Rule\"" | where disabled=0 AND 'action.summary_index'=0 | table "eai:acl.app",title
- After the upgrade is complete, update the affected correlation searches so that the searches no longer create notable events.
Upgrade Enterprise Security on a search head cluster
Before you upgrade a Splunk Enterprise Security search head cluster, review these instructions and the order of operations.
- Prepare a staging instance.
- Upgrade the staging instance to the latest version.
- Migrate the upgraded installation to the production deployer.
- Deploy the changes to the cluster members.
- Validate the configuration on the search head cluster.
Versions of these instructions published prior to August 15, 2017, if followed precisely, might have caused you to deploy default apps included with Splunk Enterprise to your search peers using the deployer. Deploying default apps in this way is not recommended.
If you experience problems with your deployment as a result of this misconfiguration, migrate the settings of your installation to a new deployer and search head cluster, similar to the steps for migrating a standalone search head to a search head cluster. See Migrate an existing search head to a search head cluster on this page.
- Review the add-ons included in the Splunk Enterprise Security package.
- If needed, upgrade Splunk Enterprise to the latest version compatible with this version of Splunk Enterprise Security.
Prepare a staging instance
Before upgrading, you need to compare the copy of Splunk Enterprise Security on the deployer with the latest release. You can do this by performing the upgrade on a staging instance. If you have a testing or QA instance in your Splunk environment with only Splunk Enterprise installed, you can use that instance for staging.
- Prepare a single instance of Splunk Enterprise to use for staging an upgrade. Do not connect the instance to indexers or search peers.
- Copy the apps in the deployer instance path
etc/shcluster/appsto the staging instance path
For example, on the deployer type:
scp -r ~/etc/shcluster/apps <staging_machine>:~/etc/
If the deployer includes default apps, such as the search app, remove them from the deployer before copying the folder to the staging instance.
The copy of Splunk Enterprise Security on the deployer includes configuration settings that are deployed to the search head cluster. The copy does not include the runtime knowledge object changes replicated between the search head cluster nodes.
Upgrade the staging instance to the latest version
- Follow steps one through four in the Upgrade Splunk Enterprise Security process.
- Review the ES Configuration Health dashboard to identify changes in configurations and settings between the deployed version and the latest release of Splunk Enterprise Security.
The installer automatically disables deprecated apps or add-ons. An alert displays in Messages on the staging instance and identifies all deprecated items. You must manually remove a deprecated app or add-on from the Enterprise Security installation.
Migrate the upgraded ES install to the deployer
Move the apps that comprise Splunk Enterprise Security from the staging instance to the deployer.
- On the staging instance, copy the apps, SAs, DAs, and TAs associated with the Splunk Enterprise Security Suite from the
$SPLUNK_HOME/etc/appsdirectory to the
$SPLUNK_HOME/etc/shcluster/appsdirectory on the deployer.
- Do not copy any of the deprecated apps or add-ons that you noted during the upgrade on staging.
- Do not copy any of the default apps, such as the search, launcher, or gettingstarted apps.
Do not copy all of the apps in the
$SPLUNK_HOME/etc/apps directory, because you do not want to upgrade and deploy apps included with Splunk Enterprise.
Deploy the changes to the cluster members
- On the deployer, deploy Enterprise Security with
-preserve-lookups trueto retain lookup file content generated on the search head cluster members. See Deploy a configuration bundle in Distributed Search.
See Maintain lookup files across app upgrades in the Splunk Enterprise Distributed Search Manual for more about using this setting.
Validate the configuration on the search cluster
After you distribute the copy of Enterprise Security on the deployer to the search head cluster members, use the ES Configuration Health dashboard to compare the cluster-replicated knowledge objects to the latest installation of Enterprise Security.
- Log in to Splunk Web on a search head cluster member.
- Open Enterprise Security.
- From the Enterprise Security menu bar, select Audit > ES Configuration Health.
- Review potential conflicts and changes to the default settings.
See ES Configuration Health in Use Splunk Enterprise Security.
Migrate an existing search head to a search cluster
An Enterprise Security standalone search head or search head pool member cannot be added to a search head cluster. To migrate ES configurations to a search head cluster:
- Identify any custom configurations and modifications in the prior ES installation. Check to make sure there is no local copy of ess_setup.conf that could conflict with the default one when you deploy Enterprise Security to the cluster.
- Implement a new search head cluster.
- Deploy the latest version of Enterprise Security on the search head cluster.
- Review and migrate the customized configurations to the search head cluster deployer for replication to the cluster members.
- Shut down the old ES search head.
For more information on settings migration, see Migrate from a standalone search head to a search head cluster in the Splunk Enterprise Distributed Search Manual.
For assistance in planning a Splunk Enterprise Security deployment migration, contact the Splunk Professional Services team.
Planning an upgrade of Splunk Enterprise Security
This documentation applies to the following versions of Splunk® Enterprise Security: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5, 4.7.6