Documentation: 3.0.2
|  Print Version Contents
This page last updated: 08/05/08 02:08pm

Upgrading to a later 3.0.x maintenance release

These instructions apply when you update from any 3.0+ release to any 3.0.1 or higher release.

Depending on your installation method, you may have to perform one step to successfully upgrade from Splunk 3.0 to 3.0.1.

For rpm, pkg, and deb upgrades

If you rpm -u or use other native package upgrade options, your $SPLUNK_HOME/etc directory will be moved to etc.bak and replaced with the shipping etc. As a result you will not see your license file, users, inputs, etc.

  1. Create a backup of your /etc directories:
    • cp -a $SPLUNK_HOME/etc/ $SPLUNK_HOME/etc.bak
  2. Upgrade Splunk using rpm -U on the Splunk rpm or pkg file.
  3. Restore your configuration to the upgraded installation by copying your backed up /etc directories and files. Copy the following directories and files as indicated:
    • $SPLUNK_HOME/etc.bak/auth/* to $SPLUNK_HOME/etc/auth/
    • $SPLUNK_HOME/etc.bak/passwd to $SPLUNK_HOME/etc/
    • $SPLUNK_HOME/etc.bak/bundles/local/* to $SPLUNK_HOME/etc/bundles/local/
    • $SPLUNK_HOME/etc.bak/splunk.license to $SPLUNK_HOME/etc/splunk.license
    • For any bundles directories you have created in your existing installation, copy:
      • $SPLUNK_HOME/etc.bak/bundles/<your bundles>/ to $SPLUNK_HOME/etc/bundles/

IMPORTANT: Copy these files and directories individually. Do not copy the entire $SPLUNK_HOME/etc.bak directory back to /etc. If you do so, the version number and other information will be incorrect.

Contact support with any questions.

For tar upgrades

For tar upgrades, it's not necessary to restore your configuration as with rpm/pkg/deb. However, Splunk recommends that you back up your /etc directories.

  1. Create a back up of your etc directories.
    • cp -a $SPLUNK_HOME/etc/ $SPLUNK_HOME/etc.bak
  2. Upgrade Splunk using tar on the Splunk tar file.
Previous: Upgrading 2.1.x or 2.2.x to 3.0.x    |    Next: Getting Help

Comments

  1. @unixsa:

    if you have found that the directory is consistently not created when doing an RPM install, please file a ticket with support@splunk.com. thanks!
    Posted by emma on Sep 12 2008, 5:07pm

  2. I stand corrected, but the directory is not created when you use rpm -U to update splunk
    Posted by unixsa on Jul 07 2008, 9:42am

  3. This line "$SPLUNK_HOME/etc.bak/bundles/local/* to $SPLUNK_HOME/etc/local/ ", should read "$SPLUNK_HOME/etc.bak/bundles/local/* to $SPLUNK_HOME/etc/bundles/local/ ". There is no directory named "$SPLUNK_HOME/etc/local/"
    Posted by unixsa on Jul 07 2008, 9:32am

Log in to comment.