Splunk® Enterprise

Distributed Deployment Manual

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Upgrade the Windows universal forwarder

This topic describes the procedure for upgrading your Splunk universal forwarder from version 4.2.x to 4.3.

The upgrade process is much simpler than the original installation. The MSI does a straight-forward upgrade with no configuration changes. If you need to change any configuration settings on your forwarders, you can do so after the upgrade, preferably through the deployment server.

Important: Before doing an upgrade, consider whether you really need to. In most cases, there's no compelling reason to upgrade a forwarder. Forwarders are always compatible with later version indexers, so you do not need to upgrade them just because you've upgraded the indexers they're sending data to.

This topic describes three upgrade scenarios:

  • Upgrade a single forwarder with the GUI installer
  • Upgrade a single forwarder with the command line installer
  • Perform a remote upgrade of a group of forwarders

For deployments of any size, you will most likely want to use this last scenario.

Before you upgrade

Be sure to read this section before performing an upgrade.

Back your files up

Before you perform the upgrade, we strongly recommend that you back up your Splunk configuration files. For information on backing up configurations, read "Back up configuration information" in the Admin manual.

Splunk does not provide a means of downgrading to a previous version; if you need to revert to an older forwarder release, just uninstall the current version and reinstall the older release.

Upgrade using the GUI installer

You can upgrade a single forwarder with the GUI installer:

1. Download the new MSI file from the Splunk universal forwarder download page.

2. Double-click the MSI file. The Welcome panel is displayed. Follow the onscreen instructions to upgrade the forwarder.

Note: You do not need to stop the forwarder before upgrading. The MSI will do this automatically as part of the upgrade process.

3. The forwarder will start automatically when you complete the installation.

The installer puts a log of upgrade changes in %TEMP%. It also reports any errors in the Application Event log.

Upgrade using the command line

You can upgrade a single forwarder by running the command line installer. To upgrade a group of forwarders, you can load the command line installer into a deployment tool, as described below.

Here are the steps for using the command line installer to upgrade a single forwarder:

1. Download the new MSI file from the Splunk universal forwarder download page.

2. Install the universal forwarder from the command line by invoking msiexec.exe.

  • For 32-bit platforms, use splunkuniversalforwarder-<...>-x86-release.msi:
      msiexec.exe /i splunkuniversalforwarder-<...>-x86-release.msi [AGREETOLICENSE=Yes /quiet]
  • For 64-bit platforms, use splunkuniversalforwarder-<...>-x64-release.msi:
      msiexec.exe /i splunkuniversalforwarder-<...>-x64-release.msi [AGREETOLICENSE=Yes /quiet]

The value of <...> varies according to the particular release; for example, splunkuniversalforwarder-4.2-86454-x64-release.msi.

Important: You cannot make configuration changes during upgrade. If you specify any command line flags besides "AGREETOLICENSE", the MSI just ignores them.

Note: You do not need to stop the forwarder before upgrading. The MSI will do this automatically as part of the upgrade process.

3. The forwarder will start automatically when you complete the installation.

The installer puts a log of upgrade changes in %TEMP%. It also reports any errors in the Application Event log.

Perform a remote upgrade

To upgrade a group of forwarders across your environment:

1. Load the universal forwarder MSI into your deployment tool. In most cases, you will want to run the command like this:

   msiexec.exe /i splunkuniversalforwarder-<...>.msi AGREETOLICENSE=Yes /quiet

See the previous section, "Upgrade using the command line", for details on the MSI command.

2. Execute deployment with your deployment tool.

3. Use the deployment monitor to verify that the universal forwarders are functioning properly.

You might want to test the upgrade locally on one machine before performing a remote upgrade across all your forwarders.

PREVIOUS
Upgrade your distributed environment
  NEXT
Upgrade the universal forwarder for *nix systems

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters