Installation

Upgrading to Splunk 5.0 queries -

chimbudp
Contributor

I need to Upgrade my Splunk version 4.3.x to 5.

Queries :
If i STOP the Splunkd service , what will be the state of Hot bucket?
Where the newly received logs from forwarders go (or) temporarily queued for Splunkd to Up?
Can i STOP the Splunk service and take the hot bucket backup and restore in my new instance ?

Kindly please help.

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Some of this does not make sense. Are you planning an in-place upgrade, or an upgrade as part of a migration to another machine? An upgrade in conjunction with a migration is a more complex operation, and if you have enterprise support I would recommend opening a case to discuss the steps and get their recommendations for the smoothest upgrade experience.

If you stop splunkd on your indexer, then ALL buckets - hot, warm, or cold - will be quiesed and closed. There will be no active updates to any of them, and you can take a full offline backup.

While Splunkd is down, forwarders will not be able to communicate with the indexer. Depending on how you have your forwarders configured and the types of inputs you are processing, some data will be queued. How much and for how long is a function of your configuration. Once you exceed what can be queued, it is possible for some to be lost. Larger queues, persistent queues, or indexer acknowledgement will affect how much data can be held at the forwarder and for how long.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Some of this does not make sense. Are you planning an in-place upgrade, or an upgrade as part of a migration to another machine? An upgrade in conjunction with a migration is a more complex operation, and if you have enterprise support I would recommend opening a case to discuss the steps and get their recommendations for the smoothest upgrade experience.

If you stop splunkd on your indexer, then ALL buckets - hot, warm, or cold - will be quiesed and closed. There will be no active updates to any of them, and you can take a full offline backup.

While Splunkd is down, forwarders will not be able to communicate with the indexer. Depending on how you have your forwarders configured and the types of inputs you are processing, some data will be queued. How much and for how long is a function of your configuration. Once you exceed what can be queued, it is possible for some to be lost. Larger queues, persistent queues, or indexer acknowledgement will affect how much data can be held at the forwarder and for how long.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...