Upgrading Splunk version from 6.0.1 to 6.6.1 then 7.2.1

[marisstella]

Hello everyone!!
We are currently running at 6.0.1 of Splunk version and using SearchHead Pooling mechanism..
We want to upgrade to 7.2.1v.
So first we planned to upgrade to 6.6.1 then 7.2.1v...
So can I get any inputs on this upgradation? (Like is that okay or anything)

Which component should be upgraded first?? And what is the sequence?
We are currently using 16Gb ram and ordered 32Gb RAM for SH, Indexer, so is that sufficient??
Is there any separate process for SH, INDEXER POOLING??

[vnravikumar]

Hi

check this

https://answers.splunk.com/answers/750462/whats-the-order-of-operations-for-upgrading-splunk.html

[DenM]

Hello,

Yes i think it's and good idea to upgrade asap, you could directly upgrade to 7.3. Before doing the upgrade backup all you apps (or deployement server) and the critical conf files (/etc/system of all your splunk instances).

Prepare carefully the upgrade, check the compability matrix/release notes of the critical apps used in your infra and check if it's supported or if you need an upgrade too. Upgrading Splunk it's not the biggest work i think your case, upgrading all your apps need a good preparation. My advice, Create a document with all your apps/version, servers, and prepare your upgrade.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Capacity/Referencehardware

This documents will help you too: (read carefully the first one)
https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/AboutupgradingREADTHISFIRST

https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/UpgradeonUNIX

[chinmoya]

I don't think you need to upgrade first to 6.6.1 and then to 7.2.1.
You can directly upgrade to 7.2.1
The component sequence wouldn't matter much.

Also, from your information, it's unclear if you have a clustered or distributed system. Or are using license master and/or cluster master.
But if you are, I suggest first upgrade your license master and/or cluster master and then other components.

One piece of advice. Splunk has done quite a few changes in 7.2.X version. Make sure your dashboards and reports are compatible with the version before upgrade.