Upgrade a single unprivileged instance

It is now possible to upgrade directly to later releases of Splunk SOAR (On-premises).

Privileged deployments upgrade directly to Splunk SOAR (On-premises) release 5.3.6, convert to unprivileged, then immediately upgrade to Splunk SOAR (On-premises) release 6.1.1.

Unprivileged deployments upgrade directly to Splunk SOAR (On-premises) release 6.1.1

See Splunk SOAR (On-premises) upgrade overview and prerequisites for more information.

Follow these steps to upgrade your unprivileged instance, or to convert and upgrade your existing, privileged instance to an unprivileged instance. Use these steps even if your unprivileged instance has limited access to the internet. The installation TAR file contains everything needed to complete this upgrade.

Converting a privileged instance to an unprivileged instance cannot be undone. Make sure you wish to convert before running the upgrade.

1. Make sure you have read upgrade overview and prerequisites.
2. Update the operating system and installed packages. See Prepare your deployment for upgrade.
3. Download the Official Unprivileged Tarball file from the Splunk SOAR site.
   1. (Conditional) If you do not see the Official Unprivileged Tarball on the product downloads page, you must submit a support request to get access.
4. Log in to the instance's operating system as the user account that runs . On an unprivileged virtual machine image or AMI-based deployment, this user account is "phantom."
5. If you use a warm standby or use ibackup.pyc for backups, you must disable those features before proceeding. If you are not using either of those features, you may skip these sub-steps.
   1. Disable warm standby. See Upgrade or maintain warm standby instances in Administer .
   2. If you are using automation to run ibackup.pyc to make backups, cancel backups that could run during your upgrade window. For example, if you have configured a cron job to run ibackup.pyc, disable that cron job.
   3. Disable WAL archiving for the PostgreSQL database. Set the archive_mode to "off" in the file <$PHANTOM_HOME>/data/db/postgresql.phantom.conf.

      sed -i -e 's/archive_mode = on/archive_mode = off/i' /<$PHANTOM_HOME>/data/db/postgresql.phantom.conf

   4. Restart PostgreSQL to make the configuration change take effect. For upgrading a system that is running PostgreSQL version 11:

      /<$PHANTOM_HOME>/bin/phsvc restart postgresql-11

6. As the user 'phantom', copy the installation tar file to the directory where is installed. This is the PHANTOM_HOME​ directory. On an unprivileged virtual machine image or AMI-based deployment, this directory is /opt/phantom/.
7. As the user 'phantom', extract the installation tar file.

   tar -xvzf phantom-<version>.tgz

8. Run the upgrade script with the nohup command. Using nohup helps you avoid issues in case the SSH session times out, such as upgrade failure or system wipe and rebuild.

   nohup /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh upgrade --no-prompt --without-apps

   To upgrade all the installed apps during the platform upgrade:

   nohup /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh --no-prompt upgrade

   Because upgraded apps may require changes to their asset configuration, apps should be individually evaluated and upgraded using Main Menu > Apps, then clicking the APP UPDATES button.

9. If you are converting a privileged instance to an unprivileged instance as part of an upgrade, run the upgrade script. See Convert a privileged deployment to an unprivileged deployment for more information.

   sudo /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/phantom_tar_install.sh upgrade

   Do this only if upgrading from Splunk Phantom 4.10.7 to Splunk SOAR (On-premises) 5.0.1.

10. If the upgrade script produced the following message:

    To improve database performance, after completing the upgrade, run: /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages

    Then run the command:

    /<$PHANTOM_HOME>/bin/phenv /<$PHANTOM_HOME>/usr/postgresql/bin/vacuumdb -h /tmp --all --analyze-in-stages

11. After the upgrade is complete, from Main Menu > Administration > Administration Settings > Search Settings, select Playbooks from the drop-down menu, then click the Reindex Search Data button.