Upgrade Splunk Forwarder from 5.0.x to 6.x.x

Source : http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/UpgradetheNixforwarder

In my case, it’s from 5.0.5 to 6.2.2. It’s not a must, but because the old version had this bug (SPL-87651) so I need to upgrade it to the 6.x.x. Also my Indexer Splunk is already on 6.2.2

Please consider the compatibility note between the indexer and forwarder:


  1. Default installation folder (oracle linux) : /opt/splunk
  2. Backup folder $SPLUNKHOME/etc/, it contains the configuration files of the old version. Just in case something happens
  3. Copy the rpm installation to machine
  4. Stop splunk service
    cd $SPLUNKHOME/bin/
    ./splunk stop
  5. rpm -U filerpm.rpm
  6. Start splunk service (to start the migration)
    cd $SPLUNKHOME/bin/
    ./splunk start –accept-license
    yes if you are sure

Check it out, whether your indexer can work it out in the browser. It solves SPL-87651 known issue.


Tinggalkan Balasan

Isikan data di bawah atau klik salah satu ikon untuk log in:

Logo WordPress.com

You are commenting using your WordPress.com account. Logout /  Ubah )

Foto Google+

You are commenting using your Google+ account. Logout /  Ubah )

Gambar Twitter

You are commenting using your Twitter account. Logout /  Ubah )

Foto Facebook

You are commenting using your Facebook account. Logout /  Ubah )


Connecting to %s