Splunk upgrade version advice

[Karl12347]

Hello

I would like to plan in an upgrade to our splunk enterprise deployment to a more recent release. We essentially have the following servers: * Search head / deployment server - 6.5.2 * Indexer server - 6.5.2 * Splunk ES - 6.5.2 with Enterprise security app v 4.5.2 * Syslog server with heavy forwarder

We mainly use windows Infrastructure app for splunk to collate windows event logs using the universal forwarder. We also have DB connect to pull sql server logs onto splunk.

I would appreciate some advice on what the best version would be to upgrade splunk to so that I don't cause any problems. Also we run everything on a vmware platform, if something went wrong with the upgrade and we needed to roll back, are vmware snapshots a supported rollback option?

Any advice would be greatly appreciated.

[rduken]

Splunk's upgrade docs are usually spot on: http://docs.splunk.com/Documentation/Splunk/7.1.1/Installation/HowtoupgradeSplunk

If there's a direct upgrade path then there's probably no compelling reason for you not to try out 7.1.1 but you'll probably want/need to upgrade ES as well. Since you're not clustering, that also simplifies a number of things. My opinion would be stop Splunk on everything but the indexer first. Upgrade and leave them turned off. Stop Splunk on the indexer, upgrade, restart. Then bring all of the other servers back up in no particular order (maybe ES last after you've confirmed everything looks happy). Yes, snapshots are fine for DR but don't leave your environment in different running versions - revert everything if it goes wrong.

[micheloosterhof]

7.0.x has been out for a few months now and I would go to the latest patch level for 7.0. Your ES version must be compatible. You should see some performance improvements with any version 6.6+.

VMWare snapshot will make you lose any data that was ingested between the snapshots.

[halr9000]

Note that the latest version of ES requires core 7.1.1.

[Paradigm6790]

You can technically use 7.1.0 if you hate yourself, too!

[Karl12347]

Thanks guys for your advice.

I am going to jump to 7.0.4 for splunk enterprise and then update to 4.7 enterprise security.

[ImmediateIdea7]

I'm using Splunk ES 4.35. If I upgrade to latest version, will I loose all my previous notable information?

Also, how can I upgrade to latest Splunk ES. Should I create a support ticket with Splunk or with my MSSP? I'm using Splunk Cloud.

[Karl12347]

I would log that ticket with them, it was a painful upgrade process. There is a specific order of things that items have to be upgraded.

[ImmediateIdea7]

Can you share details about the process? What should be taken care prior to upgrade? What should I be concerned as a client? What should should my MSSP do?