As unix support staff drafted to be an inexperienced Splunk support staffer, I hope I can appeal to someone who knows what they are doing.
I've been tasked with updating about 15 Solaris hosts to the current version of Splunk. These hosts are all SplunkEnterprise installs that only perform forwarding. The funky part is that they are version 4.1.3, so it appears that I'll have to perform three in-place upgrades to bring each of them up to current. We do have a deployment server in place (that I don't have access to) which handles the configurations and the app forwarding to a cluster of indexers. No filtering is occurring as far as I can tell. My customer has already committed that we can leave logging offline for several hours during the upgrade process in order to handle the process more easily (as long as we reprocess the current system logs).
Given the number of steps involved, and having to coordinate with other staff for the deployment server, would it make more sense to simply replace the installation on each host with a new universal forwarder?
thanks in advance.....
↧