Documentation: 3.1.5
|  Print Version Contents
This page last updated: 02/27/08 06:02pm

Upgrading a forwarder from 2.x to 3.x

The procedure for upgrading a Splunk forwarder from 2.x to 3.x is identical to that of any Splunk install, with a few additional steps.

Note: This procedure assumes you have set the $SPLUNK_HOME environment variable. To do this, execute the following command (where pathtoSplunk = the path to your Splunk install).

  • source pathtoSplunk/bin/setSplunkEnv

To upgrade a forwarder from 2.x to 3.x

  1. Follow the procedures for upgrading Splunk 2.x to 3.x.
  2. Patch splunkd.xml.
    1. Go to the directory containing splunkd.xml.
      • cd $SPLUNK_HOME/etc/myinstall
    2. Apply the patch for forwarders to splunkd.xml.
      • patch -p0 < /path/to/splunkd.xml-2.x-3.x-forwarder.patch
  3. Convert config.xml to outputs.conf.
    1. Go to the TCP directory.
      • cd $SPLUNK_HOME/etc/modules/output/TCP.
    2. Execute the following command:
      • $SPLUNK_HOME/bin/splunk _internal configfix-fwd config.xml -save-to $SPLUNK_HOME/etc/bundles/local/outputs.conf
  4. Rename config.xml and to config.xml.old (to have a back-up).
    • mv config.xml config.xml.old
  5. If you have enabled local indexing, add the key indexAndForward=true under the [tcpout] stanza in outputs.conf. If you haven't enabled local indexing, skip this step.
  6. Start Splunk.

Your upgrade is now complete.

Previous: Upgrading from Splunk versions 3.0.x through 3.1.x to Splunk versions 3.1.x through 3.1.5    |    Next: Getting Help

Comments

No comments have been submitted.

Log in to comment.