Upgrade to a new version of Splunk App for Infrastructure

To complete this task, you must be an administrator familiar with clustered environments on Splunk Enterprise.

When you upgrade to a new version of SAI, install the new package directly over your existing deployment in Splunk Enterprise. Integration with Splunk IT Service Intelligence (ITSI) is enabled by default. If you're upgrading ITSI while SAI is already installed in your environment, the SAI version is automatically upgraded to the most recent version.

Before you upgrade

Learn important information and tips about the upgrade process.

• If you're monitoring metrics for Windows systems, update Windows Performance Monitor (perfmon) stanzas in inputs.conf for the Splunk Add-on for Infrastructure and each universal forwarder on a Windows system. Version 1.4.0 introduced new perfmon stanzas that migrate perfmon inputs from a log-based format to a metrics-based format. If you're upgrading from a version earlier than version 1.4.0, you have to update inputs.conf on every universal forwarder and props.conf on every indexer. You won't receive perfmon data from Windows systems you're monitoring until you update inputs.conf and props.conf. For more information about updating perfmon stanzas, see Upgrade to a new version of Splunk App for Infrastructure that's monitoring Windows systems.
• If you're upgrading from version 1.2.0 or 1.2.1, remove the limits.conf file from the $SPLUNK_HOME/etc/apps/splunk_app_infrastructure/default directory.
• Review the release notes, known issues, and system requirements for the version you are upgrading to.
• Back up your existing deployment before you perform any upgrade.
  • You can manage upgrade risk by using technology that lets you restore your installation and data to a state prior to the upgrade, whether that is external backups, disk or file system snapshots, or other means. When backing up your data, consider the $SPLUNK_HOME directory and any indexes outside of it.
• Downgrading SAI isn't supported.

Upgrade to new version of SAI

1. Before you upgrade, back up all of your files.
2. Obtain a new version of SAI. Go to Splunkbase.
3. Open a shell prompt on the host that has the instance that you want to upgrade.
4. Change to the $SPLUNK_HOME/bin directory.
5. Run the $SPLUNK_HOME/bin/splunk stop command to stop the instance.
6. Confirm that no other processes can automatically start SAI.
7. Install the package directly over your existing deployment. See Install the Splunk App for Infrastructure.
8. Run the $SPLUNK_HOME/bin/splunk start command, or go to the user interface and restart the application.