Clean up older installations

If you have Splunk for VMware 1.0.2 installed and deployed in your environment and you want to upgrade to version 2.0, you can overwrite the current installation with the new installation if you have not manually customized your app environment.

Do not overwrite your installation and be sure to save your domain add-ons from the current Splunk for VMware version that you have installed (so that they are preserved when you install Splunk for Vmware 2.0), if you have:

• manually changed the search head
• manually added views to the domain add-ons
• manually changed existing views
• modified the indexes.

Changes made to the App from within the App environment are stored within the App and are automatically preserved during the upgrade process. Modifications you make to files outside of the app must be preserved manually.

During the upgrade process you will have a choice of deleting/disabling the domain Add-ons from the 1.0.2 version of the App. Removing them frees up a small amount of disk space.

Remove the Splunk App for VMware

To remove the Splunk App for VMware from all of your search heads/indexers:

1. Stop Splunk on all search heads/indexers where the Splunk App for VMware was installed.
2. Copy your $SPLUNK_HOME/etc/apps/splunk_for_vmware/local directory to a temporary location. The local directory contains all of the customizations that you made in the App (custom views, saved searches, macros, and so on).
3. Go to $SPLUNK_HOME/etc/apps/splunk_for_vmware to locate the App and remove the entire App directory and all of its sub-directories on all of your search heads / indexers.
4. Remove all of the old VMware data on all of your search heads/indexers:

   splunk clean eventdata vmware -f

5. You can now install Splunk for VMware 2.0 on your search heads/indexers. See the Splunk for VMware Installation and Configuration Guide for detailed instructions. If you do not want to install Splunk for VMware, you can start your Splunk instance on all of your search heads/indexers now.

Remove the Splunk Add-on for vCenter

To remove the Splunk Add-on for vCenter from your vCenter Server forwarders:

1. On the vCenter Server machines where the previous Splunk Add-on for vCenter version was installed, shut down the Splunk forwarder.
2. If you created an inputs.conf.template file (containing your VC instance name) in $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter/local, copy it to a temporary location.
3. Remove the entire Add-on directory, $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter , and all of its sub-directories on all of your vCenter Servers.
4. You can now install Splunk for VMware 2.0 on your vCenter forwarders. See the Splunk for VMware Installation and Configuration Guide for instructions on how to do this. If you do not want to install Splunk for VMware 2.0, start the Splunk forwarder on all of your vCenter Servers now.

Shut down and de-commission the Splunk FA VM

To shut down and de-commission the Splunk FA VM:

1. Log into the FA VM as the “splunkadmin” user.
2. Stop splunk in the FA VM:

   splunk stop

3. Copy all custom configurations that you made in your FA VM (for example, outputs.conf, engine.conf, inputs.conf) and save a copy of your “local” config files to a temporary location. You can find all the files in #: $SPLUNK_HOME/etc/apps/splunk_for_vmware/local or $SPLUNK_HOME/etc/system/local.
4. Shutdown the OS and halt operation:

   sudo shutdown –h now

5. Your previous FA VM version is now de-commissioned and you can deploy a new version of the FA VM. See the Splunk for VMware Installation and Configuration Guide for instructions on how to install Splunk for VMware 2.0