Splunk® Enterprise

Installation Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Upgrade to 6.4 on UNIX

This topic describes the procedure for upgrading your *nix Splunk Enterprise instance.

Before you upgrade

Read this information before proceeding, as well as the following:

Back your files up

Before you perform the upgrade, back up all of your files, including Splunk Enterprise configurations, indexed data, and binaries.

For information on backing up data, read "Back up indexed data" in the Managing Indexers and Clusters Manual.

For information on backing up configurations, read "Back up configuration information" in the Admin Manual.

Splunk Enterprise does not provide a means of downgrading to previous versions. If you need to revert to an older Splunk release, uninstall the upgraded version and reinstall the version you want.

How upgrading works

Splunk Enterprise does not change your configuration until after you restart it. You can run the migration preview utility at that time to see what will change before the software updates the files.

If you choose to view the changes before proceeding, the upgrade script writes the proposed changes to the $SPLUNK_HOME/var/log/splunk/migration.log.<timestamp> file.

Steps for upgrading

1. Execute the $SPLUNK_HOME/bin/splunk stop command.

2. Confirm no other processes can start Splunk Enterprise automatically.

3. To upgrade and migrate from version 5.0 and later, install the Splunk Enterprise package over your existing deployment:

  • If you use a .tar file, expand it into the same directory with the same ownership as your existing Splunk Enterprise instance. This overwrites and replaces matching files but does not remove unique files. tar zxf splunk-6.x.x-<version-info>.tgz -C /splunk/parent/directory
  • If you use a package manager, such as RPM, type rpm -U splunk_package_name.rpm
  • If you use a .dmg file on Mac OS X, double-click it and follow the instructions. Be sure to specify the same installation directory as your existing installation.

4. Execute the $SPLUNK_HOME/bin/splunk start command.

Splunk Enterprise displays the following output:

This appears to be an upgrade of Splunk.
Splunk has detected an older version of Splunk installed on this machine. To
finish upgrading to the new version, Splunk's installer will automatically
update and alter your current configuration files. Deprecated configuration
files will be renamed with a .deprecated extension.
You can choose to preview the changes that will be made to your configuration
files before proceeding with the migration and upgrade:
If you want to migrate and upgrade without previewing the changes that will be
made to your existing configuration files, choose 'y'.
If you want to see what changes will be made before you proceed with the
upgrade, choose 'n'.
Perform migration and upgrade without previewing configuration changes? [y/n]

5. Choose whether or not you want to run the migration preview script to see proposed changes to your existing configuration files, or proceed with the migration and upgrade right away. If you choose to view the expected changes, the script provides a list.

6. After you review these changes and are ready to proceed with migration and upgrade, run $SPLUNK_HOME/bin/splunk start again.

Note: You can complete Steps 4 to 6 in one line:

To accept the license and view the expected changes (answer 'n') before continuing the upgrade:

$SPLUNK_HOME/bin/splunk start --accept-license --answer-no

To accept the license and begin the upgrade without viewing the changes (answer 'y'):

$SPLUNK_HOME/bin/splunk start --accept-license --answer-yes
Last modified on 19 September, 2016
Changes for Splunk App developers
Upgrade to 6.4 on Windows

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters