upgrading to 4.3.2

[mattj81]

im going to be upgrading from splunk 4.2 to 4.3.2 on windows 2008 x64. ive backed up \program files\splunk\ and all its sub-folders to be safe.

can i just run the latest .msi through without any issues?

thanks!

[mattj81]

apologies, shouldnt of read that so quick! can i confidentally just run the .msi through to upgrade to this version then? thanks 🙂

[mattj81]

ahh right, which version would you go to then if 4.3.2 isnt stable?

[ChrisG]

4.3.1, as jeff said in his previous answer.

[jeff]

I'd caution you to hold off installing 4.3.2 on Windows if you intend to collect data from the Windows Event Logs. There's a known issue where Windows Event Logs are not read properly (issue SPL-51312 ; see answer 47535 for more background). Splunk and the Universal Forwarder v4.3.1 don't have this problem...

[ChrisG]

Good point there. SPL-51312 is fixed in the forthcoming 4.3.3 maintenance release.

[ChrisG]

You should definitely read About Upgrading to 4.3 READ THIS FIRST in the Installation Manual. Step-by-step instructions about performing the upgrade itself follow that topic. It's hard to answer your question specifically without knowing a little more about your Splunk deployment. You'll want to back up your indexed event data and your configuration data. There are some changes in 4.3 on Windows, like host name normalization, that you will want to be aware of. The documentation should give you what you need.

[ChrisG]

Again, it's hard to answer without knowing more. It depends on what your current setup is. Do you have scripted inputs defined in inputs.conf? Do you have searches that expect fully-qualified domain names? If something stops working after you upgrade, you can specify a host name using the "host" attribute for that particular input.

[mattj81]

thanks for the response! ive backed up everything mentioned in the document....will host name normailization break my current setup then?