Upgrade Splunk IT Essentials Work on a single instance

At this time, you can't install Splunk IT Essentials Work from the Splunk Web interface.

Follow these steps to upgrade Splunk IT Essentials Work (ITE Work) on an on-premises search head. ITE Work supports upgrades from up to three minor versions before the version you're upgrading to. If you are upgrading from a version lower than three minor versions from the version you want to upgrade to, you have to perform step upgrades. Splunk Cloud Platform customers have to work with Splunk Support to coordinate upgrades to ITE Work.

Before upgrading

• Perform all prerequisite steps specified before upgrading ITE Work. See Before you upgrade ITE Work.
• ITE Work supports upgrades from up to three versions prior.

Install the latest version of ITE Work

On a single-instance deployment, a single Splunk Enterprise instance serves as both the search head and indexer.

You have to upgrade ITE work by extracting the ITE Work installation package. ITE Work doesn't support installation using the app manager in Splunk Web or the splunk install app command in the command line.

1. Log in to splunk.com with your credentials.
2. Download the latest version of ITE Work from Splunkbase.
   1. You have to read and accept the license terms and conditions to download the app.
   2. Depending on your system, you might be prompted to keep the executable file.
3. Stop your Splunk platform.
   For example, on *nix:

   cd $SPLUNK_HOME/bin
   ./splunk stop
   

4. Extract the installation package into $SPLUNK_HOME/etc/apps. See Start and stop Splunk Enterprise for steps to do so in your specific environment.
   For example, on *nix:

   tar -xvf it-essentials-work_<latest_version>.spl -C $SPLUNK_HOME/etc/apps
   

   On Windows, rename the file extension from .spl to .tgz first and use a third-party utility to perform the extraction.

5. Restart your Splunk platform. See Start and stop Splunk Enterprise for steps to do so in your specific environment.
   For example, on *nix:

   cd $SPLUNK_HOME/bin
   ./splunk start
   

6. The first time you go to ITE Work after installing the new files, a migration screen steps you through the upgrade process. For Skip over localized failures, select whether to skip over the following types of failures:
   • Missing dependencies in service KPIs, such as a missing macro
   • Multiple entity split or filter fields in KPI base searches
   • Missing dependencies in KPI base searches
   • Missing dependencies in correlation searches
   • Duplicate services

   Skipping over these failures means the problematic objects aren't migrated. You'll receive a list of skipped objects when the upgrade completes.

7. Select Start Upgrade. The migration script runs to migrate existing ITE Work knowledge objects to the new version.
8. When the upgrade completes, open the ITE Work home page.

To check migration related logs, run the following Splunk search:

index=_internal "[itsi.migration]"

Upgrade indexers

You have to place the SA-IndexCreation add-on on all indexers. For nonclustered distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers. Indexers have to be running a compatible version of Splunk Enterprise. If you upgrade your indexers, verify whether you have to also upgrade your search heads. For information, see Splunk Enterprise version compatibility in the Splunk Enterprise Managing Indexers and Clusters of Indexers manual.

If you have an indexer cluster, use the configuration bundle method to replicate SA-IndexCreation across all peer nodes. On the primary node, place a copy of SA-IndexCreation in $SPLUNK_HOME/etc/master-apps/. For information about updating peers in an indexer cluster, see Manage app deployment across all peers in the Splunk Enterprise Managing Indexers and Clusters of Indexers manual.

Validate the upgrade

The ITE Work upgrade process is now complete. Objects disabled during the upgrade process are automatically reenabled. ITE Work shows the following message: IT Service Intelligence upgrade has completed successfully.

1. In Splunk Web, select Help > About to verify that the upgrade was successful.
2. Clear the browser cache of the browser you use to access Splunk Web. If you don't clear the browser cache, some pages might fail to load.

You can also check the installed version, latest version, and previous version by running the following search:

| rest splunk_server=local /services/apps/local/itsi | stats values(version) as itsi_installed_version | join [|inputlookup itsi_migration_check]

After upgrading

If the upgrade fails, see Roll back an upgrade of Splunk IT Essentials Work.