Splunk® Enterprise

Installation Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Upgrade to 6.4 on Windows

This topic describes the procedure for upgrading your Windows Splunk Enterprise instance. You can upgrade with either the GUI installer or the msiexec utility on the command line as described in "Install on Windows via the command line".

Before you upgrade

Read this information before proceeding, as well as the following:

Make sure you specify the same domain user

If you installed Splunk Enterprise with a domain user, you must explicitly specify the same domain user during an upgrade. If you do not, Splunk Enterprise defaults to using the Local System User. If you accidentally specify the wrong user during your upgrade, use these instructions to switch to the correct user before you start Splunk Enterprise.

Don't change the ports

Splunk Enterprise does not support changing the management or Splunk Web ports when you upgrade. If you need to change these ports, do so either before or after you upgrade.

Back your files up

Before you upgrade, back up all of your files, including Splunk Enterprise configurations, indexed data and binaries.

For information on backing up data, see Back up indexed data in the Managing Indexers and Clusters manual.

For information on backing up configurations, see Back up configuration information in the Admin manual.

Keep copies of custom certificate authority certificates

When you upgrade on Windows, the installer overwrites any custom certificate authority (CA) certificates you have created in %SPLUNK_HOME%\etc\auth. If you have custom CA files, back them up before you upgrade. After the upgrade, you can restore them into %SPLUNK_HOME%\etc\auth. After you have restored the certificates, restart Splunk Enterprise.

Don't attempt to downgrade after you've upgraded

Splunk does not provide a means of downgrading to previous versions.

After you upgrade Splunk Enterprise, if you need to downgrade, you must uninstall the upgraded version and then reinstall the previous version of Splunk Enterprise that you were using. Do not attempt to install over an upgraded installation with an installer from a previous version. Doing so can result in a corrupt instance and data loss.

Upgrade using the GUI installer

1. Download the new MSI file from the Splunk download page.

2. Double-click the MSI file. The installer runs and attempts to detect the existing version of Splunk Enterprise installed on the machine. When it locates the older version, it displays a pane that asks you to accept the licensing agreement.

3. Accept the license agreement. The installer then installs the updated Splunk Enterprise, retaining all parameters from the existing installation. By default, the installer restarts Splunk Enterprise when the installation completes.

The installer places a log of the changes made to configuration files during the upgrade in %TEMP%.

Upgrade using the command line

1. Download the new MSI file from the Splunk download page.

2. Perform the installation, as described in Install on Windows via the command line.

  • If Splunk runs as a user other than the Local System user, you must explicitly specify this user in your command-line instruction with the USERNAME flag.
  • You can use the LAUNCHSPLUNK flag to specify whether Splunk Enterprise should start up automatically or not when you're finished, but you cannot change any other settings.
  • Do not change the ports (SPLUNKD_PORT and WEB_PORT) at this time.

3. Depending on your specification, Splunk Enterprise might start automatically when you complete the installation.

The installer places a log of the changes made to configuration files during the upgrade in %TEMP%.

Last modified on 05 April, 2017
Upgrade to 6.4 on UNIX
Migrate a Splunk Enterprise instance

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters