Splunk® SOAR (On-premises)

Install and Upgrade Splunk SOAR (On-premises)

The visual editor for classic playbooks was removed from Splunk SOAR in release 6.4.0. Convert your classic playbooks to modern mode. Your classic playbooks will continue to run and you can view and edit them in the SOAR Python code editor.
For details, see:

Migrate a Splunk SOAR (On-premises) install from Amazon Linux 2 to Amazon Linux 2023

Support for Amazon Linux 2023 was added with the release of version 6.4.0. This topic provides a high-level overview of the process for migrating your host's operating system to Amazon Linux 2023.

Amazon does not provide an operating system upgrade package for upgrading Amazon Linux 2 to Amazon Linux 2023. Their migration method is to create a new instance using Amazon Linux 2023, deploy your application on the new host, then change the CNAMEs to point traffic to your new instance. See Migration from Amazon Linux 2 to Amazon Linux 2023 in the AWS Elastic Beanstalk Developer Guide.

This article focuses on the current Splunk SOAR (On-premises) release. You can upgrade to any Splunk SOAR (On-premises) release 6.4.0 or higher.

Operating system upgrade or migration checklist

Use this table as a guide to migrating or upgrading your Splunk SOAR (On-premises) host or cluster node hosts to Amazon Linux 2023.

Step Description
1 Make a full backup of your existing Splunk SOAR (On-premises) host or cluster. See Splunk SOAR (On-premises) backup and restore overview.
2 Download the Splunk SOAR (On-premises) release 6.4.0 installation TAR file for your current operating system. You will need to copy the installation TAR file to each host you intend to upgrade. See Get Splunk SOAR (On-premises).
3 Upgrade your existing Splunk SOAR (On-premises) deployment or cluster nodes to release 6.4.0.
  1. Upgrade your Splunk SOAR (On-premises) deployment to release 6.4.0. See Splunk SOAR (On-premises) upgrade overview and prerequisites.
  2. Once your Splunk SOAR (On-premises) deployment has been has been upgraded to release 6.4.0, make a new full backup of Splunk SOAR (On-premises). See Splunk SOAR (On-premises) backup and restore overview.
4 Prepare a new AWS host running Amazon Linux 2023.
  1. Download the correct installation TAR file for your new operating system. See Get Splunk SOAR (On-premises).
  2. Install Splunk SOAR (On-premises) release 6.4.0 on your new AWS host running Amazon Linux 2023. See Install Splunk SOAR (On-premises) as an unprivileged user.
5 Restore your backup of Splunk SOAR (On-premises) 6.4.0 on Amazon Linux 2 to your new instance of Splunk SOAR 6.4.0 on Amazon Linux 2023. See Upgrade your Splunk SOAR (On-premises) deployment on Amazon Linux 2 to a new Amazon Linux 2023 host by using backup and restore.
6 If you are upgrading a Splunk SOAR (On-premises) cluster, see Upgrade the Splunk SOAR (On-premises) cluster by adding and removing cluster nodes.

Upgrade your Splunk SOAR (On-premises) deployment on Amazon Linux 2 to a new Amazon Linux 2023 host by using backup and restore

This method involves creating a new Amazon Linux 2023 system for your and restoring your existing to the new host.

Do the following tasks.

  1. If you have not already done so, upgrade your current deployment to the current release. See Splunk SOAR (On-premises) upgrade overview and prerequisites.
  2. After your upgrade to the current release is complete, make a full backup of of your current release deployment. See Back up a Splunk SOAR (On-premises) deployment.
  3. Create a new instance of the current where the operating system is Amazon Linux 2023. See Install Splunk SOAR (On-premises) as an unprivileged user.
  4. Use the backup created earlier to restore the original deployment to the new deployment. See Restore Splunk SOAR (On-premises) from a backup.
  5. Update DNS CNAME records to replace your Splunk SOAR deployment on Amazon Linux 2 with your new Splunk SOAR (On-premises) release 6.4.0 on Amazon Linux 2023.

Upgrade the Splunk SOAR (On-premises) cluster by adding and removing cluster nodes

If you are upgrading a Splunk SOAR (On-premises) cluster, after you have restored your backup to the new Amazon Linux 2023 host, upgrade your cluster nodes by building new cluster nodes, adding them to your cluster, then decommissioning cluster nodes running earlier versions of Splunk SOAR (On-premises). For information on adding or removing cluster nodes from your Splunk SOAR (On-premises) cluster, see Add or remove a cluster node from Splunk SOAR (On-premises).

Last modified on 05 March, 2025
Migrate a Splunk SOAR (On-premises) install from Oracle Linux 8 to Oracle Linux 9   Migrate from Splunk SOAR (On-premises) to Splunk SOAR (Cloud)

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.4.0

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters