Splunk® Phantom (Legacy)

Install and Upgrade Splunk Phantom

This documentation does not apply to the most recent version of Splunk® Phantom (Legacy). For documentation on the most recent version, go to the latest release.

Troubleshoot upgrade issues

In the event something goes wrong during your upgrade, check the following sections for help.

Restoring the PostgreSQL 9.4 database in the event the upgrade fails

If you experience problems upgrading your PostgreSQL database, you can restore your database from backup and proceed with the the upgrade after solving any other issues.

Example problems:

  • System overflows available disk space.
  • Disk mount becomes unavailable due to network or other issue.
  • System crashes for issues unrelated to the database during upgrade.

You will need to to recreate the local PostgreSQL database, then restore your data from a backup.

Actions to take to restore the PostgreSQL database:

  1. Log in to the Splunk Phantom instance's operating system as either the root user or a user with sudo privileges.
  2. Run the recreate_local_db.py script to reinitialize the local PostgreSQL database.
    /opt/phantom/bin/recreate_local_db.py

    Running this script will destroy any existing data in the local database.

  3. Restore the PostgreSQL database from your backup.
    sudo phenv python ibackup.pyc --restore <path/to/<number>_phantom_backup.tar>
    See Backup or restore your Splunk Phantom instance in Administer Splunk Phantom.
  4. Verify that your Splunk Phantom data has been restored.
  5. Redo the upgrade.
Last modified on 08 December, 2020
Upgrade an unprivileged Splunk Phantom Cluster   Migrate a Splunk Phantom install from REHL 6 or CentOS 6 to RHEL 7 or CentOS 7

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.9


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters