Upgrade

This topic describes how to upgrade Splunk App for VMware to the latest released version.

Splunk App for VMware 3.1.1 runs on Splunk version 6.0.2 or later. See"How to upgrade Splunk Enterprise".

Upgrade Splunk App for VMware and the data collection node

1. Download Splunk App for VMware 3.1.1 from Splunk Apps to the location in your environment in which you installed the previous version of Splunk App for VMware.

2. Stop Splunk Enterprise.

3. Install splunk_forwarder_for_vmware-<version>-<build_number>.zip by copying the splunk_forwarder_for_vmware-<version>-<build_number>.zip file from the download package, and pasting it into $SPLUNK_HOME.

4. Unzip the file in $SPLUNK_HOME. The file automatically unzips into the $SPLUNK_HOME/etc/apps directory.

5. Confirm that the following data collection components exist in $SPLUNK_HOME/etc/apps:

• SA-Utils/…
• SA-Hydra/…
• SA-Threshold/…
• SA-VMW-HierarchyInventory/…
• SA-VMW-LogEventTask/…
• SA-VMW-Performance/…
• SA-VMW-Licensecheck/…
• Splunk_TA_vcenter/…
• splunk_for_vmware/…
• Splunk_TA_vmware/…
• Splunk_TA_esxilogs/…

6. Delete the $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local/hydra_job.conf file.

7. Upgrade from verion 3.0.1 or earlier. To upgrade the .ova for the data collection node included in Splunk App for VMware 3.0.1 or earlier, complete the following steps:

a. Create SSL certificates using the following command: $SPLUNK_HOME/bin/splunk createssl web-cert

b. Update iptables in Linux to enable port 8008. 8008 is the default port for the gateway.

8. Start Splunk Enterprise.

Remove Licensecheck packages

To address a known issue that produces benign license check error messages, remove the SA-VMW-Licensecheck package from your installation.

1. Copy the vmware_licensecheck.py file from the $SPLUNK_HOME\etc\apps\SA-VMW-Licensecheck\bin folder to the $SPLUNK_HOME\etc\apps\splunk_for_vmware\bin folder.

2. Change the following line in the vmware_licensecheck.py file from:

namespace = 'SA-VMW-Licensecheck'

to

namespace = 'splunk_for_vmware'.

3. Remove the SA-VMW-Licensecheck folder from the $SPLUNK_HOME\etc\apps folder.

4. Restart your instance of Splunk Enterprise.