Upgrade an unprivileged Splunk Phantom Cluster

It is now possible to upgrade directly to later releases of Splunk SOAR (On-premises) from Splunk Phantom 4.10.7.

Privileged deployments upgrade directly to Splunk SOAR (On-premises) release 5.3.6, convert to unprivileged, then immediately upgrade to Splunk SOAR (On-premises) release 6.1.1.

Unprivileged deployments upgrade directly to Splunk SOAR (On-premises) release 6.1.1

See Splunk Phantom upgrade overview and prerequisites for more information.

Perform the following tasks to upgrade your unprivileged Splunk Phantom cluster. These steps can also be used to convert an existing privileged Splunk Phantom cluster to an unprivileged cluster.

1. Read Splunk Phantom upgrade overview and prerequisites.
2. Prepare each node for upgrade:
   1. On each cluster node, update the operating system and installed packages: See Prepare your Splunk Phantom deployment for upgrade.
   2. On each cluster node, install the Splunk Phantom source repositories and signing keys. See Splunk Phantom repositories and signing keys packages.
3. On each node, one at a time, Upgrade individual cluster nodes.
4. If the upgrade script produced the following message:

   To improve database performance, after completing the upgrade, run: /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages

   Then run the command:

   /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages

5. Once all cluster nodes have been upgraded, reindex playbook data. From Main Menu > Administration > Administration Settings > Search Settings, select Playbooks from the drop-down menu, then click the Reindex Search Data button.

Upgrade individual cluster nodes

Do not attempt to upgrade all the nodes at the same time. Upgrade a single node and bring it back online before proceeding to the next cluster node.

When you have upgraded N+1 nodes, where N is equal to half of the number of nodes in you cluster, database migrations will be applied. This can take a significant amount of time, depending on the amount of data in your database and the version of Splunk Phantom from which you're upgrading.

Do these steps as the user that owns the PHANTOM_HOME directory.

1. Log in to the operating system as the user who owns the PHANTOM_HOME directory.
2. Run the upgrade script with the nohup command. Using nohup helps you avoid issues in case the SSH session times out, such as upgrade failure or system wipe and rebuild.

   nohup /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh upgrade --no-prompt --without-apps

   To upgrade all the installed apps during the platform upgrade:

   nohup /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh --no-prompt upgrade

   Because upgraded apps may require changes to their asset configuration, apps should be individually evaluated and upgraded using Main Menu > Apps, then clicking the APP UPDATES button.

   Or run the upgrade script on a privileged installation to convert and upgrade your Splunk Phantom instance to an unprivileged instance. See Convert a privileged deployment to an unprivileged deployment for more information.

   sudo /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh upgrade

If you are converting a privileged cluster to an unprivileged cluster, you will need to configure your load balancer to listen for HTTPS traffic on both TCP 443 and TCP 9999 because the Splunk Phantom daemons will use port 9999 for HTTPS.