Upgrade

This topic discusses how to upgrade the Splunk App for VMware to the latest version.

The Splunk App for VMware 3.1.0 runs on Splunk version 6.0.2 or later installed in a Unix or Linux environment. See the topic "How to upgrade Splunk" in the Splunk Enterprise documentation if you need to upgrade your Splunk instance. Review the "System Requirements" in this manual if you are not familiar with the requirements for getting started.

Why Upgrade

Upgrade to the latest release of the Splunk App for VMware to get:

• Support for very large scale environments with a scalable and distributed data collection architecture for API data.
• Support for Splunk versions 6.0.2 and later.
• Support for the Splunk Common Information Model.
• Enhanced licensing capabilities.
• Fixed issues since the last software release.

Backup your existing deployment

Before you upgrade, we recommend that you backup your existing deployment. For more information about backing up your Splunk deployment, read the topics "Back up configuration information" in the Admin Manual and "Back up indexed data" in the Managing Indexers and Clusters Manual.

Upgrade a distributed deployment

To upgrade your distributed Splunk environment, read "Upgrade your distributed environment" in the Distributed Deployment Manual for instructions on how to do this with minimal impact.

Upgrade steps

Download the Splunk App for VMware 3.1.0 from Splunk Apps to a location in your environment. For instructions on how to do this, read "Download the Splunk App for VMware" in this manual.

Upgrade the data collection node

1. Stop Splunk.
2. Install splunk_forwarder_for_vmware-<version>-<build_number>.zip.Get the file splunk_forwarder_for_vmware-<version>-<build_number>.zip from the download package and put it in $SPLUNK_HOME.
3. Unzip this file (the data collection node components) from $SPLUNK_HOME. The file automatically unzips into the $SPLUNK_HOME/etc/apps directory.
4. Check that the data collection components SA-Utils, SA-Hydra, Splunk_TA_vmware, and Splunk_TA_esxilogs exist in $SPLUNK_HOME/etc/apps.
5. Delete the file $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local/hydra_job.conf
6. To upgrade the .ova for the DCN provided in the Splunk App for VMware version 3.0.1 release or below, do the following:
   1. $SPLUNK_HOME/bin/splunk createssl web-cert
   2. Update iptables in linux to enable port 8008. (8008 is the default port for the Gateway.)
7. Start Splunk.

Upgrade the search head

1. Stop the scheduler before performing an upgrade. You can do this by stopping Splunk on the search head, or you can stop the scheduler in the Collection Configuration page of the app.
2. Install the Splunk App for VMware. Follow the instructions in the topic "Install Splunk App for VMware" in this manual.
3. Once installed, start Splunk if you stopped it, or restart the scheduler in the Collection Configuration page of the app.

Validate your installation

Now that you have upgraded to the latest release, you can validate that the Splunk App for VMware is installed correctly and that data is coming in. In the Splunk App for VMware Installation and Configuration Guide, see the topic "Launch Splunk Web" for more information.