Roll back an upgrade of Splunk IT Essentials Work
If your upgrade to a new version of IT Essentials Work (ITE Work) fails, you can restore it to the previous state using the backup/restore functionality in either ITE Work or Splunk Enterprise. A JSON-formatted ITE Work backup of the search head is automatically created before an ITE Work upgrade begins. This back up is stored in $SPLUNK_HOME/etc/apps/SA-ITOA/lib. You can restore this backup using ITE Work backup/restore functionality.
To roll back your ITE Work upgrade follow these steps:
Upgrade Splunk IT Essentials Work on a search head cluster
Uninstall ITE Work
This documentation applies to the following versions of Splunk® IT Essentials Work: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.6, 4.13.0, 4.13.1