Upgrade an unprivileged Splunk Phantom Cluster
It is now possible to upgrade directly to later releases of Splunk SOAR (On-premises) from Splunk Phantom 4.10.7.
Privileged deployments upgrade directly to Splunk SOAR (On-premises) release 5.3.6, convert to unprivileged, then immediately upgrade to Splunk SOAR (On-premises) release 6.1.1.
Unprivileged deployments upgrade directly to Splunk SOAR (On-premises) release 6.1.1
See Splunk Phantom upgrade overview and prerequisites for more information.
Perform the following tasks to upgrade your unprivileged Splunk Phantom cluster. These steps can also be used to convert an existing privileged Splunk Phantom cluster to an unprivileged cluster.
- Read Splunk Phantom upgrade overview and prerequisites.
- Prepare each node for upgrade:
- On each cluster node, update the operating system and installed packages: See Prepare your Splunk Phantom deployment for upgrade.
- On each cluster node, install the Splunk Phantom source repositories and signing keys. See Splunk Phantom repositories and signing keys packages.
- On each node, one at a time, Upgrade individual cluster nodes.
- If the upgrade script produced the following message: Then run the command:
To improve database performance, after completing the upgrade, run: /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages
/<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages
- Once all cluster nodes have been upgraded, reindex playbook data. From Main Menu > Administration > Administration Settings > Search Settings, select Playbooks from the drop-down menu, then click the Reindex Search Data button.
Upgrade individual cluster nodes
Do not attempt to upgrade all the nodes at the same time. Upgrade a single node and bring it back online before proceeding to the next cluster node.
When you have upgraded N+1 nodes, where N is equal to half of the number of nodes in you cluster, database migrations will be applied. This can take a significant amount of time, depending on the amount of data in your database and the version of Splunk Phantom from which you're upgrading.
Do these steps as the user that owns the PHANTOM_HOME directory.
- Log in to the operating system as the user who owns the PHANTOM_HOME directory.
- Run the upgrade script with the
nohup
command. Usingnohup
helps you avoid issues in case the SSH session times out, such as upgrade failure or system wipe and rebuild.To upgrade all the installed apps during the platform upgrade:nohup /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh upgrade --no-prompt --without-apps
nohup /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh --no-prompt upgrade
Because upgraded apps may require changes to their asset configuration, apps should be individually evaluated and upgraded using Main Menu > Apps, then clicking the APP UPDATES button.
Or run the upgrade script on a privileged installation to convert and upgrade your Splunk Phantom instance to an unprivileged instance. See Convert a privileged deployment to an unprivileged deployment for more information.sudo /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh upgrade
If you are converting a privileged cluster to an unprivileged cluster, you will need to configure your load balancer to listen for HTTPS traffic on both TCP 443 and TCP 9999 because the Splunk Phantom daemons will use port 9999 for HTTPS.
Upgrade a Splunk Phantom cluster | Migrate a Splunk Phantom install from REHL 6 or CentOS 6 to RHEL 7 or CentOS 7 |
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7
Feedback submitted, thanks!