Upgrade to Splunk App for VMware 4.0.2 from 3.4.7

Splunk App for VMware version 3.4.7 contains advanced XML modules, and because Splunk version 8.x does not support advanced XML modules, upgrade the app before upgrading your Splunk Enterprise version to 8.x.

Download the files from Splunkbase

1. Download the Splunk App for VMware version 4.0.1 from Splunkbase to a location in your environment.
2. Download the Splunk Add-on for VMware version 4.0.1 from Splunkbase to a location in your environment.
3. Download the Splunk OVA for VMware version 4.0.1 from Splunkbase to a location in your environment.

Upgrade the search head

Make sure '''splunk_vmware_admin''' role has '''admin_all_objects''' capability.

For search head cluster deployments

1. On etc/shcluster/apps, rename the package "SA-VMNetAppUtils" to "SA-VMNetAppUtils-backup".
2. Upgrade all the components on the search head deployer. Components are located in etc/shcluster/apps.
3. If Splunk_TA_vmware is present on the search head do the following:
   1. Copy the local folder from etc/apps/Splunk_TA_vmware from the search head to etc/shcluster/apps/TA-VMW-FieldExtractions on the deployer.
   2. Delete Splunk_TA_vmware from etc/shcluster/apps/ on the deployer.
4. Go to etc/shcluster/apps/SA-VMNetAppUtils-backup/ and copy the local directory to the etc/shcluster/apps/SA-VMNetAppUtils/ directory.
5. Delete the SA-VMNetAppUtils-backup directory from etc/shcluster/apps/ on the deployer.
6. Delete splunk_for_vmware/appserver/modules from etc/shcluster/apps/on the deployer.
7. Push the app bundle from deployer.
8. Enable the acceleration for data models "VMwareInventory" and "VMwarePerformance". See Enable Data model acceleration and use data models to learn how to enable data model acceleration.

The deployer restarts all the search head cluster members after the upgrading. If the deployer does not restart the search head cluster members, perform a rolling restart.

For dedicated search head deployments

1. On etc/apps, rename the package "SA-VMNetAppUtils" to "SA-VMNetAppUtils-backup".
2. Upgrade all the components on the search head Components are located in etc/apps.
3. If Splunk_TA_vmware is on the search head:
   1. Copy the local folder from etc/apps/Splunk_TA_vmware directory to the etc/apps/TA-VMW-FieldExtractions directory on the search head.
   2. Delete Splunk_TA_vmware from etc/apps.
4. Go to etc/apps/SA-VMNetAppUtils-backup/ and copy the local directory to the etc/apps/SA-VMNetAppUtils/ directory.
5. Delete the SA-VMNetAppUtils-backup directory from etc/apps.
6. Delete splunk_for_vmware/appserver/modules frometc/apps.
7. Restart Splunk on the search head.
8. Enable the acceleration for data models "VMwareInventory" and "VMwarePerformance". See Enable Data model acceleration and use data models to learn how to enable data model acceleration.

Validate the Splunk App for VMware upgrade on your search head

Validate that you correctly upgraded the Splunk App for VMware to the latest version and that the app can collect data.

1. Log in to the Splunk App for VMware on your search head.
2. When the app displays the Splunk for VMware Setup page, select the Delete all deprecated Add-ons checkbox under Disable/delete old add-ons. The app removes all legacy add-ons from the installation. This removes saved searches of SA-VMW-Performance that are no longer in use.
3. Save your configurations, and restart your Splunk platform deployment.

Manually remove legacy add-ons

If you launched Splunk App for VMware but did not check Delete all deprecated Add-ons on the setup page, you can manually remove the legacy add-ons from your installation.

1. Stop the Splunk platform on your search head.
2. Delete the hydra_job.conf file in the $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local folder on the Splunk Search head.
3. Remove the SA-VMW-Licensecheck folder from the $SPLUNK_HOME/etc/apps folder on your Splunk search head. Do this for each server upon which you installed the Splunk App for VMware.
4. The below table shows the specific legacy add-ons, located in the $SPLUNK_HOME/etc/apps/Splunk_TA_vmware/local folder of the Splunk App for VMware, to delete when upgrading:
• DA-VMW-HierarchyInventory
• DA-VMW-LogEventTask
• DA-VMW-Performance
• SA-VMW-Licensecheck
5. Restart your Splunk platform.

Upgrade the add-on on the scheduler, DCN, and indexer

Next, you must upgrade the add-on on the scheduler, DCN, and indexer. See Upgrade to Splunk Add-on for VMware 3.4.7.

Additional information

See "Platform and Hardware Requirements" in this manual for supported Splunk platform versions for this release. See "How to upgrade Splunk Enterprise" to upgrade to a new version of the Splunk platform.

For information on upgrading from tsidx namespaces to data model acceleration, see the "Upgrade from tsidx namespaces to data model acceleration" section of the troubleshooting section of this manual.