Remotely upgrade your universal forwarders

You can set up delivery using a deployment server or a third party delivery product as follows:

• Download the universal forwarder package and signature and insert them into the delivery app at ./local/packages/ dir, then deploy them with the deployment server.
• Update your local_config and deploy it using the deployment server. See Modify remote upgrader using the configuration files for more information.
• Use the deployment server to deliver the Splunk Remote Upgrader for Linux package.

Prerequisite: Prepare the delivery package

Before using the Remote Upgrader for Linux Universal Forwarders to upgrade your universal forwarders, prepare the universal forwarder packages by downloading them along with the signature associated with the package from splunk.com.

Using the deployment server or your own third-party delivery method, deliver the package and associated signature file to the primary universal forwarder.

If you have three different universal forwarders installed using RPM, DEB, and TGZ, you can deliver all three of these packages to all the universal forwarders, without specifying which universal forwarder needs which package.

You cannot load multiple packages that are the same type. If there are two packages with one type, for example, two RPM packages, the Remote Upgrader for Linux Universal Forwarders will not not be able to determine which package should be used and the Remote Upgrader for Linux Universal Forwarders aborts the upgrade.

Deliver your universal forwarder packages using the deployment server

You can deliver the universal forwarder packages using the deployment server and trigger the already running Remote Upgrader for Linux Universal Forwarders to run through the upgrade process. You can do this whether your universal forwarders are running as root or non-root.

1. Download the universal forwarder packages.
2. Place the universal forwarder packages and its associated signature file in the ./local/packages directory under splunk_app_upgrader_delivery.
3. If you have not already done so, make splunk_app_upgrader_delivery available to the deployment server. See Update configurations for more information.
4. Deploy the Remote Upgrader app to the target universal forwarders using the deployment server. The universal forwarder packages are delivered to the Remote Upgrader for Linux Universal Forwarders /tmp/SPLUNK_UPGRADER_MONITORED_DIR directory, and the trigger file is created automatically.
5. When you deploy the Remote Upgrader app using the deployment server, update the interval setting in ./default/inputs.conf to a cron expression based on Splunk inputs.conf. This will keep the app from triggering the universal forwarder upgrade until the cron expression starts the input.

Deliver the target universal forwarder package into the designated folder

If you use a custom solution for delivery you can also use your solution to deliver the package manually and create a trigger file:

1. Place the installer package in the /tmp/SPLUNK_UPGRADER_MONITORED_DIR directory.
2. Create the file start_uf_upgrade in /tmp/SPLUNK_UPGRADER_MONITORED_DIR directory. This is the trigger file that separates the package delivery and upgrade, which lets you better arrange the upgrade. The file can be empty. Do not copy and paste this file from another location to this monitored directory, as creation time for this file determines the timeout for the universal forwarder upgrade and changing the default flag file may cause upgrade failure.