Question 1: What is the upgrade procedure?

Review the following points to determine the appropriate upgrade procedure.

<Point 1-1>

• composition
  The procedure differs depending on whether you have a single configuration or a cluster configuration.

<Point 1-2>

• upgrade path
  Depending on the version you are using, you may need to upgrade in stages to reach the target version.
  Example) v 8.0.x → v 8.2.x → v 9.1 etc.

<Points 1-3>

• Version compatibility with forwarders
  The forwarder and indexer (in this case, a single Splunk Enterprise) are version compatible. Therefore, if compatibility is lost, you will need to upgrade the forwarder version as well.

When responding to support, we will check the current environment based on the content of your inquiry and guide you through the steps based on the points mentioned above.

・Environmental information (excerpt)

• OS on which Splunk is installed: Linux version 3.10.0-1160.el7.x86_64
• Splunk configuration: 1 unit configuration
• Splunk Enterprise current version/updated version: 7.3.x → 9.0.x
• Universal forwarder version: 7.3.x

Answer ①

<Assumption>

• About version upgrade path
  You cannot directly upgrade your version to v9.0, so you will need to upgrade to v8.1 once.
• About forwarder version upgrades The universal forwarder v7.3 you are using is compatible with indexer v9.0. However, as the full support period has ended, we recommend upgrading.
  *You can check the support period for each product below.
  https://www.splunk.com/en_us/legal/splunk-software-support-policy.html

In addition, if you want to upgrade the forwarder to v9.0, just like the indexer, you need to first upgrade to v8.1 and then to v9.0.

<Version upgrade procedure>

• The steps for upgrading are as follows.

1. Stop universal forwarder
2. stop indexer
3. Indexer version upgrade
   1. Disable Splunk's autostart settings if you have them enabled.
   2. Take backup of settings and data area
   3. Run the target version installer
   4. Grant the Splunk execution user access to the installation directory
   5. Enable Splunk autostart settings if needed
4. Universal forwarder version upgrade
   1. Disable Splunk's autostart settings if you have them enabled.
   2. Take configuration backup
   3. Run the target version installer
   4. Grant the Splunk execution user access to the installation directory
   5. Enable Splunk autostart settings if needed
5. start indexer
6. start forwarder
   *More detailed instructions will be provided during support.

Question 2: Will the imported logs be deleted by version upgrade?

Answer ②

Splunk stores configuration files and data areas separately, and version updates are performed only on configuration files. Therefore, even if you upgrade the version, the logs that have been acquired will not be deleted. However, please back up your configuration files and data area just in case.

Question 3: Is there anything I should be careful about to ensure that the dashboard (App) I use for work is not affected?

<Point 3-1>

• Python versions supported by Splunk
  Starting with Splunk Enterprise 8.0, the supported Python version has changed from 2.7 to 3.7. As a result, depending on the App/Add-on you are using, it may not be compatible with Python3.7 and may not work properly when upgraded to Splunk Enterprise 8.0 or later. Therefore, it is necessary to check compatibility and take measures in advance.

① Check on Splunkbase (https://splunkbase.splunk.com/)

You can check by going to the target App/Add-on page > [Compatibility].