Upgrade

Upgrade the Splunk App for VMware to the latest released version. See Platform and hardware requirements for supported Splunk Enterprise versions for this release. See "How to upgrade Splunk Enterprise" to upgrade to a new version of Splunk Enterprise.

Reasons to Upgrade to 3.1.3

Upgrade to the latest Splunk App for VMware releases to get the latest version of the Distributed Collection Scheduler. See "Distributed Collection Scheduler requirements".

Also see the Known issues and Fixed issues in the Splunk App for VMware Release Notes.

Upgrade to Splunk App for VMware 3.1.3

Download the Splunk App for VMware 3.1.3 from Splunk Apps to a location in your environment. See "Download Splunk App for VMware" in this manual.

Upgrade the Splunk search head

1. Stop the Distribution collection scheduler before you upgrade. You can do this by stopping Splunk Enterprise on the Splunk search head, or you can stop the Distribution collection scheduler in the Collection configuration page of the app.

2. Get the splunk_app_for_vmware-<version>-<build_number>.zip file and put it in $SPLUNK_HOME on your Splunk search head.

3. Unzip the Splunk App for VMware package.

cd /opt/splunk

unzip splunk_app_for_vmware-<version>-<build_number>.zip

4. Confirm that the following components exist in $SPLUNK_HOME/etc/apps:

• SA-Utils/…
• SA-Hydra/…
• SA-Threshold/…
• SA-VMW-HierarchyInventory/…
• SA-VMW-LogEventTask/…
• SA-VMW-Performance/…
• Splunk_TA_vcenter/…
• splunk_for_vmware/…
• Splunk_TA_vmware/…
• Splunk_TA_esxilogs/…

5. Delete legacy add-ons. Edit the $SPLUNK_HOME/etc/apps/splunk_for_vmware/local/app.conf file and change the value of is_configured to 0. The app sets the value to 1, by default, to prevent the Set up page displaying each time you launch it.

6. Remove the SA-VMW-Licensecheck folder, if it exists, from the $SPLUNK_HOME/etc/apps folder.

7. Restart Splunk Enterprise, if you stopped it, or restart the distributed collection scheduler in the Collection Configuration page of the app.

Upgrade the Splunk data collection node

Note: If you have a 3.0.x data collection node that you deployed using a 3.0.x Splunk OVA, you can upgrade to the latest data collection node configuration by deploying the Splunk OVA version 3.1.3. See "Deploy OVA to create a Data Collection Node" in this manual. Optionally, you can use these instructions to upgrade the 3.0.x data collection node in your environment.

1. Stop Splunk Enterprise on the data collection node.

2. Get the file splunk_forwarder_for_vmware-<version>-<build_number>.zip from the download package and put it in $SPLUNK_HOME.

3. Unzip splunk_forwarder_for_vmware-<version>-<build_number>.zip from $SPLUNK_HOME. The file automatically unzips into the $SPLUNK_HOME/etc/apps folder.

4. Check that the data collection components SA-Utils, SA-Hydra, Splunk_TA_vmware, and Splunk_TA_esxilogs exist in $SPLUNK_HOME/etc/apps.

5. Delete the file $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local/hydra_job.conf

6. (3.0.x to 3.1.3 upgrade only) If you have a 3.0.x data collection node that you deployed using a 3.0.x Splunk OVA, make these additional changes to upgrade the the data collection node in your environment.

a. Create SSL certificates.

$SPLUNK_HOME/bin/splunk createssl web-cert

b. Update iptables in linux to enable port 8008. (8008 is the default port for the Gateway.)

7. Start Splunk Enterprise.

Validate the Splunk App for VMware upgrade

Validate that you correctly upgraded the Splunk App for VMware to the latest version and that the app can collect data.

Log in to the Splunk App for VMware on a search head. When the app displays the Setup page, check Delete all deprecated Add-ons. The app removes all legacy add-ons from the installation.

Manually remove legacy add-ons

If you launched Splunk App for VMware but did not check Delete all deprecated Add-ons on the setup page, you can manually remove the legacy add-ons from your installation.

1. Stop Splunk Enterprise on your Splunk search head.

2. Delete the hydra_job.conf file in the $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local folder on the Splunk Search head.

3. Remove the SA-VMW-Licensecheck folder from the $SPLUNK_HOME/etc/apps folder on your Splunk search head. Do this for each server upon which you installed the Splunk App for VMware.

3. Upgrade from 2.5.0 or earlier: Delete the domain add-ons in the $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local folder.

• DA-VMW-HierarchyInventory
• DA-VMW-LogEventTask
• DA-VMW-Performance

4. Restart Splunk Enterprise.