Upgrade a single unprivileged Splunk Phantom instance

Follow these steps to upgrade your unprivileged Splunk Phantom instance.

If your Splunk Phantom deployment is not a cluster, and uses an external PostgresSQL database and/or an external GlusterFS file share you will need to upgrade the external services before upgrading Splunk Phantom itself.

1. Make sure you have read Splunk Phantom upgrade overview and prerequisites.
2. Update the operating system and installed packages. See Prepare your Splunk Phantom deployment for upgrade.
3. Log in to the Splunk Phantom instance's operating system as the user account that runs Splunk Phantom. On an unprivileged virtual machine image or AMI-based deployment, this user account is "phantom."
4. If you use a warm standby or use ibackup.pyc for backups, you must disable those features before proceeding. If you are not using either of those features, you may skip these sub-steps.
   1. Disable warm standby. See Upgrade or maintain warm standby instances in Administer Splunk Phantom.
   2. If you are using automation to run ibackup.pyc to make backups, cancel backups that could run during your upgrade window. For example, if you have configured a cron job to run ibackup.pyc, disable that cron job.
   3. Disable WAL archiving for the PostgreSQL database. Set the archive_mode to "off" in the file <PHANTOM_HOME>/data/db/postgresql.phantom.conf.

      sed -i -e 's/archive_mode = on/archive_mode = off/i' /<PHANTOM_HOME>/data/db/postgresql.phantom.conf

   4. Restart PostgreSQL to make the configuration change take effect. If you are upgrading a system that is running PostgreSQL version 9.4:

      /<PHANTOM_HOME>/bin/phsvc restart postgresql-9.4

      If you are upgrading a system that is running PostgreSQL version 11:

      /<PHANTOM_HOME>/bin/phsvc restart postgresql-11

5. If your Splunk Phantom instance uses an external PostgreSQL database, Upgrade PostgreSQL for Splunk Phantom deployments with external databases.
6. If your Splunk Phantom deployment uses an external GlusterFS-based file share, upgrade GlusterFS. See Upgrade GlusterFS for Splunk Phantom deployments with GlusterFS fileshares.
7. Run the upgrade script.

   /<PHANTOM_HOME>/bin/phenv /<PHANTOM_HOME>/phantom_tar_install.sh upgrade

   To upgrade without apps:

   /<PHANTOM_HOME>/bin/phenv /<PHANTOM_HOME>/phantom_tar_install.sh upgrade --without-apps

8. If the upgrade script produced the following message:

   To improve database performance, after completing the upgrade, run: /<PHANTOM_HOME>/bin/phenv /<PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages

   Then run the command:

   /<PHANTOM_HOME>/bin/phenv /<PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages

9. After the upgrade is complete, from Main Menu > Administration > Administration Settings > Search Settings, select Playbooks from the drop-down menu, then click the Reindex Search Data button.