Splunk® Enterprise

Splunk Analytics for Hadoop

Splunk Enterprise version 8.1 will no longer be supported as of April 19, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Upgrade your search head for Splunk Analytics for Hadoop

Splunk Analytics for Hadoop reaches End of Life on January 31, 2025.

Download and install the new version of Splunk

Upgrade your search head by installing the newest (Linux) version of Splunk Enterprise. Download the Linux distribution for Splunk Enterprise and install it, then add a Splunk Analytics for Hadoop license.

You can find the correct version to download here: http://www.splunk.com/download/splunk

Configure this installation to run on a search head that resides on a *nix platform. You can run Splunk Analytics for Hadoop on any machine that meets the requirements for a search head. See Configure the search head.

Splunk Analytics for Hadoop is not supported on Windows.

To learn more about installing or updating Splunk, see Install on Linux in the Installation manual.

Tar file install

To install Splunk on a Linux system, expand the tarball into an appropriate directory using the tar command: 

tar xvzf splunk_package_name.tgz

The default install directory is splunk in the current working directory. To install into /opt/splunk, use the following command: 

tar xvzf splunk_package_name.tgz -C /opt

When you install Splunk with a tarball, note the following points:

  • Some non-GNU versions of tar might not have the -C argument available. In this case, to install in /opt/splunk, either cd to /opt or place the tarball in /opt before running the tar command. This method will work for any accessible directory on your machine's filesystem.
  • Ensure that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.

Edit indexes.conf

In your indexes.conf file, edit the attribute vix.splunk.setup.package so that it provides the path to the new Splunk .tgz package that Splunk Analytics for Hadoop can install and use on data nodes. The next time MapReduce spawns a search, Splunk pushes the new package to the nodes and upgrades the version stored on on the DataNode and TaskTracker.

See Set up a provider and virtual index in the configuration file for more information about editing configuration files.

See Provider configuration variables for more information about editing this attribute in Splunk Web.

Last modified on 30 October, 2023
Set up your search head instance   Special instructions for upgrades from Hunk to Splunk Analytics for Hadoop

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters