Upgrade

This topic discusses how to upgrade the Splunk App for VMware 3.0 to the latest version.

Note that Splunk for VMware 3.0.1 relies on having Splunk version 5.0.4 or later installed. See the topic "How to upgrade Splunk" in the Splunk Enterprise documentation if you need to upgrade your Splunk instance. Review the "System Requirements" in this manual if you are not familiar with the requirements for getting started.

Why Upgrade

Upgrade to the latest release of the Splunk App for VMware to get:

• Compatibility with Splunk Enterprise 6.x.
• Support for the Splunk Common Information Model.
• Enhanced licensing capabilities.
• Fixed issues since the last software release.

Backup your existing deployment

Before you upgrade, we recommend that you backup your existing deployment. For more information about backing up your Splunk deployment, read the topics "Back up configuration information" in the Admin Manual and "Back up indexed data" in the Managing Indexers and Clusters Manual.

Upgrade a distributed deployment

If you are planning to upgrade your distributed Splunk environment, be sure to read "Upgrade your distributed environment" in the Distributed Deployment Manual for guidance on how to do so with minimal impact.

Upgrade steps

1. Download the Splunk App for VMware 3.0.1 from Splunk Apps to a location in your environment. For instructions on how to do this, read "Download the Splunk App for VMware" in this manual.

Upgrade the data collection node

1. Stop Splunk.
2. Install splunk_forwarder_for_vmware-<version>-<build_number>.zip.Get the file splunk_forwarder_for_vmware-<version>-<build_number>.zip from the download package and put it in $SPLUNK_HOME.
3. Unzip this file (the data collection node components) from $SPLUNK_HOME. It will automatically unzip into $SPLUNK_HOME/etc/apps directory.
4. Check that the data collection components SA-Utils, SA-Hydra, Splunk_TA_vmware, and Splunk_TA_esxilogs exist in /etc/apps.
5. Delete the file $SPLUNKHOME/etc/apps/Splunk_TA_vmware/local/hydra_job.conf
6. Start Splunk.

Upgrade the search head

1. If you have the scheduler running, you must stop it before upgrading the app. You can do this by stopping Splunk on the search head, or you can stop the scheduler in the Collection Configuration page of the app.
2. Install the Splunk App for VMware. Follow the instructions in the topic "Install Splunk App for VMware" in this manual.
3. Once installed, start Splunk if you stopped it, or restart the scheduler in the Collection Configuration page of the app.

Validate your installation

Now that you have upgraded to the latest release, you can validate that the App is installed correctly and that data is coming in. In the Splunk App for VMware Installation and Configuration Guide, see the topic "Launch Splunk Web" for more information.