Upgrade from 1.0 to 1.0.2

Why Upgrade

Splunk for VMware 1.0.2 contains a number of significant enhancements to the installation tools that enable you to automatically configure your environment to collect data and map it to the Splunk App for VMware. If you have Splunk for VMware 1.0 installed, upgrading to the most recent version of the software is direct. If you are still using a beta version of Splunk for VMware, then follow the instructions for upgrading from the beta software version to 1.0 before you upgrade to 1.0.2. Splunk for VMware versions 1.0 and later have a different underlying architecture than Splunk for VMware versions 1.0 beta and earlier. Note: There is no direct upgrade path from the beta versions to 1.0 and later versions. Attempting to upgrade directly from 1.0beta to 1.0 is unsupported and is strongly discouraged.

• In the Splunk Technology Add-on for VMware 1.0.2 (Splunk_TA_vmware inside the FA VM) we have extended the capabilities of the installation tools. To use the new functionality you must upgrade to the latest FA VM. You can now:

• Automatically configure multiple FA VMs using the installation tools.

• In the Splunk Technology Add-on for VMware vCenter (Splunk_TA_vcenter) 1.0.2 we have extended the log collection capability for vCenter 5 to include more logs. The collection of these logs does not require you to upgrade to the 1.0.2 App. The data will be automatically displayed in the views when you upgrade to Splunk TA-vcenter 1.0.2. The additional logs are:

• eam.log
• jointool.log
• ls.log
• pyvmomiserver.log
• vsm.log

Upgrade instructions

Follow these instructions whether you are upgrading from Splunk for VMware 1.0 to versions 1.0.1 or 1.0.2. If you need to, you can manually upgrade you installation. To do this, follow the instructions in the Solution Administration chapter in this manual.

To install Splunk App for VMware 1.0.2:

1. Replace the current installation. See Install the App in the Splunk for VMware Installation and Configuration Guide.

To install the Splunk Technology Add-on for VMware vCenter (Splunk TA-vcenter”):

1. Replace the current installation. See Install the vCenter Add-on in the Splunk for VMware Installation and Configuration Guide.

To upgrade the FA VM:

1. Log into your FA VM as the “splunkadmin” user.
2. Stop splunk:

   splunk stop

3. If you modified configuration files in the FA Add-on(engine.conf and inputs.conf), copy the contents of the directory $SPLUNK_HOME/etc/apps/splunk_for_vmware_appliance/local, where the custom configuration files reside, to a temporary location so that your changes will be preserved.
4. Remove the entire FA Add-on directory and all of its sub-directories. The FA Add-on is located in $SPLUNK_HOME/etc/apps/splunk_for_vmware_appliance.
5. Download the “Splunk Technology Add-on for VMware” from Splunkbase and transfer it to the FA VM.
6. Unzip the contents into $SPLUNK_HOME/etc/apps. This creates a $SPLUNK_HOME/etc/apps/Splunk_TA_vmware directory.
7. Copy configuration files saved earlier into the $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local directory.

   Important: If you increase the amount of data that you are collecting with the FA VM (for example, by adding more VCs and/or ESX/i hosts into your engine.conf files), you must check the resource requirements for the FA VM and increase the amount of CPU and memory resources available to your FA VM to support the load. For more information, see System Requirements in the Splunk for VMware Installation and Configuration Guide.

8. Start splunk:

   splunk start

9. Your FA VM is now upgraded and running.