Patrick Bareiss

In this blog post, the Splunk update process of a Splunk Enterprise single instance is described.

First of all, a backup of the Splunk configuration is performed:

tar cvzf splunk-backup-17-03.tar.gz /opt/splunk/etc/

Download newest version of Splunk Enterprise on the Splunk homepage. I used the wget command to download the newest Splunk Enterprise rpm file:

wget -O splunk-7.2.4.2-fb30470262e3-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.2.4.2&product=splunk&filename=splunk-7.2.4.2-fb30470262e3-linux-2.6-x86_64.rpm&wget=true'

Subsequently, stop Splunk Enterprise as splunk user:

/opt/splunk/bin/splunk stop

Install Splunk Enterprise as root user:

rpm -U splunk-7.2.4.2-fb30470262e3-linux-2.6-x86_64.rpm

Switch back to the splunk user:

su - splunk

Then, start Splunk:

/opt/splunk/bin/splunk start

I performed the migration without reviewing the configuration changes.

Afterwards, check if everything works as expected:

Thank you for reading. Leave a comment, if that helped you.