Upgrade from 1.x to 1.0.3

Why Upgrade

Upgrade to Splunk for VMware 1.0.3:

• If you have VMware vSphere 5.1 installed and running and you want to splunk the data in your vSphere 5.1 environment.
• If you are splunking a very large VMware environment and you want increased performance. We have changed the existing saved searches for summary indexing which has increased the memory performance of Splunk for VMware.

The upgrade process involves:

1. Upgrading to the new VMware vSphere™ SDK for Perl on the FA VM.
2. Downloading and installing Splunk for VMware version 1.0.3.

Note: We only support using Splunk for VMware version 1.0.3 with the VMware 5.1 Perl SDK. We do not support it with older versions of the VMware Perl SDK.

Splunk for VMware 1.0.3 also contains a number of significant enhancements to the installation tools.

If you have Splunk for VMware 1.0 installed, upgrading to the most recent version of the software is direct. If you are still using a beta version of Splunk for VMware, then follow the instructions for upgrading from the beta software version to version 1.0 before you upgrade to version 1.0.3. Splunk for VMware versions 1.x and later have a different underlying architecture than Splunk for VMware versions 1.0 beta and earlier. Note: There is no direct upgrade path from the beta versions to 1.0 and later versions. Attempting to upgrade directly from 1.0 beta to 1.0 is unsupported and is strongly discouraged.

Upgrade instructions

Follow these instructions to upgrade from 1.x to 1.0.3. Should you need to manually upgrade you installation, follow the instructions in the Solution Administration chapter in this manual.

To upgrade to Splunk App for VMware

1. Replace the current installation. See Install the App in the Splunk for VMware Installation and Configuration Guide.

Note for advanced users: If you have customized your summary index searches in your local directory, you must:

1. Remove the contents of the local directory (apps/SA-VMW-Performance/local).
2. Install the 1.0.3 release.
3. Copy the relevant macros from apps/SA-VMW-Performance/default to apps/SA-VMW-Performance/local and customize your saved searches in the macros in this local directory.

To upgrade the Splunk Technology Add-on for VMware vCenter (Splunk TA-vcenter”):

1. Replace the current installation. See Install the vCenter Add-on in the Splunk for VMware Installation and Configuration Guide.

To upgrade the FA VM:

1. Log into your FA VM as the “splunkadmin” user.
2. First upgrade the VMware vSphere™ SDK for Perl to the latest version.

   Goto VMware's website and download the VMware vSphere SDK for Perl 5.1 (64bit for linux), VMware-vSphere-Perl-SDK-5.1.0-780721.x86_64.tar.gz and copy (scp) it onto the FA. See Install the Perl API package in this manual.

3. Stop splunk:

   splunk stop

4. If you modified configuration files in the FA Add-on(engine.conf and inputs.conf), copy the contents of the directory $SPLUNK_HOME/etc/apps/splunk_for_vmware_appliance/local, where the custom configuration files reside, to a temporary location so that your changes will be preserved.
5. Remove the entire FA Add-on directory and all of its sub-directories. The FA Add-on is located in $SPLUNK_HOME/etc/apps/splunk_for_vmware_appliance.
6. Download the “Splunk Technology Add-on for VMware” from Splunkbase and transfer it to the FA VM.
7. Unzip the contents into $SPLUNK_HOME/etc/apps. This creates a $SPLUNK_HOME/etc/apps/Splunk_TA_vmware directory.
8. Copy configuration files saved earlier into the $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local directory.

   Important: If you increase the amount of data that you are collecting with the FA VM (for example, by adding more VCs and/or ESX/i hosts into your engine.conf files), you must check the resource requirements for the FA VM and increase the amount of CPU and memory resources available to your FA VM to support the load. For more information, see System Requirements in the Splunk for VMware Installation and Configuration Guide.

9. Start splunk:

   splunk start

10. Your FA VM is now upgraded and running.