We are planning to upgrade our search head from 5.0.2 to 6.2.3. The search head is also the deployment server for 100+ universal forwarders. I read in many forums that the upgrade has broken their deployment server setting. Is there a safe way for this upgrade?
It is safe if your serverclasses.conf is compatible, 😉 there we had an issue with more than one app in the same serverclass:
we had to change from:
[serverClass:ABC-ByMachineType]
whitelist.0 = *
[serverClass:ABC-ByMachineType:app:ABC-210-aix]
whitelist.0 = *
machineTypesFilter = aix-*
[serverClass:ABC-ByMachineType:app:ABC-230-linux]
whitelist.0 = *
machineTypesFilter = linux-*
To
[serverClass:ABC-ByMachineType-aix]
whitelist.0 = *
machineTypesFilter = aix-*
[serverClass:ABC-ByMachineType-aix:app:ABC-210-aix]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:ABC-ByMachineType-linux]
whitelist.0 = *
machineTypesFilter = linux-*
[serverClass:ABC-ByMachineType-linux:app:ABC-230-linux]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
but see also http://docs.splunk.com/Documentation/Splunk/6.2.4/Updating/Forwardermanagementcompatibility#List_of_...