Upgrade Splunk Industrial Asset Intelligence

You can upgrade directly to this version of Splunk IAI from version 1.2.1. The upgrade process upgrades the application and performs a data migration immediately afterward.

Upgrade Splunk Industrial Asset intelligence in a single-instance deployment

Follow these steps to upgrade a single-instance deployment of Splunk IAI.

Prerequisite

Back up Splunk IAI. See Back up and restore Splunk Industrial Asset Intelligence.

Upgrade Splunk Enterprise to 8.0.0 or later.

Enable Python 3 for your Splunk Enterprise instance.

Steps

1. Download the latest version of Splunk IAI from Splunkbase.
2. From the command line, navigate to the apps directory.
   • For *nix systems, type cd $SPLUNK_HOME/etc/apps.
   • For Windows systems, type cd %SPLUNK_HOME%\etc\apps.
3. Unpack the app package and overwrite the existing splunk_app_iai directory.
   • For *nix systems, type tar -xvzf splunk_app_iai.tgz.
   • For Windows systems, use whichever file system utility you have installed to extract and unzip the app package.
4. Change the directory to the following location:
   • For *nix system, type cd $SPLUNK_HOME/etc/shcluster/apps/splunk_app_iai/lib/splunk_app_iai_app_common/
   • For Windows systems, type cd %SPLUNK_HOME%\etc\shcluster\apps\splunk_app_iai\lib\splunk_app_iai_app_common
5. Remove the concurrent package, if it exists.
6. Change the directory to the bin directory.
   • For *nix systems, type cd $SPLUNK_HOME/bin.
   • For Windows systems, type cd %SPLUNK_HOME%\bin.
7. Restart Splunk Enterprise.
   ./splunk restart
8. After Splunk Enterprise restarts, log in to Splunk Web.
9. Wait for the Splunk IAI app to become visible. The app doesn't become visible in Splunk Web until the data migration completes.
10. Track the progress of the data migration with the INFO messages in the splunk_app_iai_data_migration.log file.
11. Check the Splunk Web messages to confirm that the upgrade succeeded.

Upgrade Splunk Industrial Asset Intelligence on multiple unclustered search heads

If your Splunk deployment uses unclustered search heads, follow these steps to upgrade Splunk IAI.

Prerequisite

Back up Splunk IAI. See Back up and restore Splunk Industrial Asset Intelligence.

Upgrade Splunk Enterprise to 8.0.0 or later.

Enable Python 3.

Steps

On each search head that has Splunk IAI installed, perform these steps.

1. Download the latest version of Splunk IAI from Splunkbase.
2. From the command line, navigate to the apps directory.
   • For *nix systems, type cd $SPLUNK_HOME/etc/apps.
   • For Windows systems, type cd %SPLUNK_HOME%\etc\apps.
3. Unpack the app package and overwrite the existing splunk_app_iai directory.
   • For *nix systems, type tar -xvzf splunk_app_iai.tgz.
   • For Windows systems, use whichever file system utility you have installed to extract and unzip the app package.
4. Change the directory to the following location:
   • For *nix system, type cd $SPLUNK_HOME/etc/shcluster/apps/splunk_app_iai/lib/splunk_app_iai_app_common/
   • For Windows systems, type cd %SPLUNK_HOME%\etc\shcluster\apps\splunk_app_iai\lib\splunk_app_iai_app_common
5. Remove the concurrent package, if it exists.
6. Change the directory to the bin directory.
   • For *nix systems, type cd $SPLUNK_HOME/bin.
   • For Windows systems, type cd %SPLUNK_HOME%\bin.
7. Restart Splunk Enterprise.
   ./splunk restart
8. After Splunk Enterprise restarts, log in to Splunk Web.
9. Wait for the Splunk IAI app to become visible. The app doesn't become visible in Splunk Web until the data migration completes.
10. Track the progress of the data migration with the INFO messages in the splunk_app_iai_data_migration.log file.
11. Check the Splunk Web messages to confirm that the upgrade succeeded.

Upgrade Splunk Industrial Asset Intelligence on a search head cluster

If your Splunk deployment uses a search head cluster, follow these steps to upgrade Splunk IAI.

Prerequisite

Back up Splunk IAI. See Back up and restore Splunk Industrial Asset Intelligence.

Upgrade Splunk Enterprise to 8.0.0 or later.

Enable Python 3.

Steps

On the search head cluster deployer, perform these steps.

1. Download the latest version of Splunk IAI from Splunkbase.
2. From the command line, navigate to the apps directory.
   • For *nix systems, type cd $SPLUNK_HOME/etc/shcluster/apps.
   • For Windows systems, type cd %SPLUNK_HOME%\etc\shcluster\apps.
3. Unpack the app package and overwrite the existing splunk_app_iai directory.
   • For *nix systems, type tar -xvzf splunk_app_iai.tgz.
   • For Windows systems, use whichever file system utility you have installed to extract and unzip the app package.
4. Change the directory to the following location:
   • For *nix system, type cd $SPLUNK_HOME/etc/shcluster/apps/splunk_app_iai/lib/splunk_app_iai_app_common/
   • For Windows systems, type cd %SPLUNK_HOME%\etc\shcluster\apps\splunk_app_iai\lib\splunk_app_iai_app_common
5. Remove the concurrent package, if it exists.
6. Deploy the changes to the search head cluster.
   ./splunk apply shcluster-bundle
   Deploying the bundle initiates a rolling restart of the search heads in the cluster. After the restart, the search head cluster captain performs a data migration.
7. On the search head cluster captain, log in to Splunk Web.
8. Wait for the Splunk IAI app to become visible. The app doesn't become visible in Splunk Web until the data migration completes.
9. Track the progress of the data migration with the INFO messages in the splunk_app_iai_data_migration.log file.
10. Check the Splunk Web messages to confirm that the upgrade succeeded.
11. Confirm that the KV store is synced across the search heads in the cluster. If needed, resync the KV store. See Resync the KV store in the Splunk Enterprise Admin Manual.

See Use the deployer to distribute apps and configuration updates for more information about pushing updates using the configuration bundle.

If the Splunk IAI upgrade fails

If you see a Splunk Web message that says the upgrade failed, the data migration failed to complete.

Review the data migration log for any ERROR or WARNING messages:

• Review the log in the file system:
  • Review the log on *nix systems in $SPLUNK_HOME/var/log/splunk/splunk_app_iai_data_migration.log
  • Review the log on Windows systems in %SPLUNK_HOME%\var\log\splunk\splunk_app_iai_data_migration.log
• Review the log inside of Splunk in the _internal index.
  

  index=_internal source=*splunk_app_iai_data_migration.log

You can also use the data migration log to track the progress of the migration with INFO messages.

If you need additional troubleshooting assistance and you have a support contract, contact customer support.