Migrate on Windows

Migrate on Windows

When you migrate, your configuration files are updated and changed to support the new functionality. You can run the migration preview utility to see what will be changed before you actually upgrade and migrate. When you do this, a file containing the changes that the script proposes to make is written to:

$SPLUNK_HOME/var/log/splunk/migration.log.<timestamp>

Before you migrate

• Review the migration concerns in "What to expect when upgrading to 4.0".
• Back up your files, including Splunk configurations, data and binaries.
• Stop Splunk either using the Windows Start menu option or by executing the $SPLUNK_HOME/bin/splunk stop command.
• Be aware that you cannot change the user Splunk runs as during an upgrade. Do not change the user from the Windows Service Control panel; Splunk will stop working. If you must change the user, you must uninstall and reinstall Splunk.
• The Windows App was enabled by default in versions 4.0-4.0.2. Starting in version 4.0.3, it is disabled by default unless you enable it explicitly via the commandline/MSI installation process.
• Disable any 'coldToFrozen' scripts in $SPLUNK_HOME/etc/system/local/indexes.conf. If you leave them in place they could potentially run when you start 4.0 for the first time and cause your instance to appear unresponsive.

Upgrade instructions

1. Download the new MSI file from the Splunk download page.

2. Double-click the MSI file.

The Welcome panel is displayed. Follow the onscreen instructions to upgrade Splunk.

For information about each panel, refer to the installation instructions.

When you reach the Install step, you have the option to preview changes that will be made for this upgrade.

3. Preview your upgrade and migration if desired.

The following text is displayed:

This appears to be an upgrade of Splunk.
 
--------------------------------------------------------------------------------
 
Splunk has detected an older version of Splunk installed on this machine. To
finish upgrading to the new version, Splunk's installer will automatically
update and alter your current configuration files. Deprecated configuration
files will be renamed with a .deprecated extension.
 
You can choose to preview the changes that will be made to your configuration
files before proceeding with the migration and upgrade:
 
If you want to migrate and upgrade without previewing the changes that will be
made to your existing configuration files, choose 'y'.
If you want to see what changes will be made before you proceed with the
upgrade, choose 'n'.
 
Perform migration and upgrade without previewing configuration changes? [y/n]

4. You're given the choice of running the migration preview script to see what changes will be made to your existing configuration files, or proceeding with the migration and upgrade right away.

5. If you choose to view the expected changes (select N), the script provides a list.

You can scroll up to review the changes or look at them in $SPLUNK_HOME/var/log/splunk/migration.log.<timestamp>. At the end of the list, you will see an error message, which you can ignore.

6. Press Enter to return to step 3 and finish your upgrade by typing Y.

Important: When migrating or upgrading, you must re-specify the user you want Splunk to run as--this information is not automatically maintained from release to release.

Start Splunk

On Windows, Splunk is installed by default into \Program Files\Splunk

You can start and stop the following Splunk processes via the Windows Services Manager:

• Server daemon: splunkd
• Web interface: splunkweb

You can also start, stop, and restart both processes at once by going to \Program Files\Splunk\bin and typing

#  splunk.exe [start|stop|restart]

Note: If you do not select Start Splunk Services now, they will be set to manual startup and therefore will not start after a reboot. You must start them from the Windows Service Manager MMC, and optionally configure auto-start if you want them to start automatically at boot time.

Important: After upgrading, Splunk may start reading some files incorrectly as binaries. You can override this behavior in props.conf by adding the following line to a source stanza: NO_BINARY_CHECK = true