Splunk® Phantom (Legacy)

Install and Upgrade Splunk Phantom

This documentation does not apply to the most recent version of Splunk® Phantom (Legacy). For documentation on the most recent version, go to the latest release.

Upgrade a single Splunk Phantom instance on a system with limited internet access

Some deployments of Splunk Phantom have deliberately limited access to the internet, making it difficult to upgrade using RPM packages. TAR file distributions of Phantom are available to upgrade these offline deployments.

To upgrade an offline Phantom deployment:

  1. Get the upgrade TAR file. See Splunk Phantom repositories and signing keys packages.
  2. Update the operating system and dependencies. See Prepare your Splunk Phantom deployment for upgrade.
  3. If your Splunk Phantom instance uses an external PostgreSQL database, Upgrade PostgreSQL for Splunk Phantom deployments with external databases.
  4. If your Splunk Phantom deployment uses an external GlusterFS-based file share, upgrade GlusterFS. See Upgrade GlusterFS for Splunk Phantom deployments with GlusterFS fileshares.
  5. Upgrade Splunk Phantom from the tar file.

Upgrade Splunk Phantom from the tar file

  1. Make sure you have read and done the steps from Splunk Phantom upgrade overview and prerequisites.
  2. Log in to the Splunk Phantom instance's operating system as either the root user or a user with sudo privileges.
  3. Make a directory for the tar file.
    mkdir /usr/local/src/upgrade-<version>
  4. Change to the directory you just created.
    cd /usr/local/src/upgrade-<version>
  5. Download or copy the TAR file to the directory you just created.
  6. Extract the TAR file.
    tar -xvzf phantom_offline_setup_<OS>-<version>.tgz
  7. Change to the directory phantom_offline_setup, which was created by extracting the TAR file:
    cd phantom_offline_setup_<OS>-<version>
  8. Run the installation script.
    ./phantom_offline_setup_<OS>.sh upgrade
    To upgrade without apps, add --without-apps to the command:
    ./phantom_offline_setup_<OS>.sh upgrade --without-apps
  9. If the upgrade script produced the following message:
    To improve database performance, after completing the upgrade, run: su - postgres -c '/usr/pgsql-11/bin/vacuumdb -h /tmp --all --analyze-in-stages'
    Then run the command:
    su - postgres -c '/usr/pgsql-11/bin/vacuumdb -h /tmp --all --analyze-in-stages'
  10. Validate the upgrade by logging in to the Splunk Phantom web interface.
  11. Once your deployment has been upgraded, reindex playbook data. From Main Menu > Administration > Administration Settings > Search Settings, select "playbooks from the drop-down menu, then click the Reindex Search Data button.
Last modified on 19 March, 2021
Upgrade a single Splunk Phantom instance   Upgrade a single unprivileged Splunk Phantom instance

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.9


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters