Upgrading the Splunk platform
Splunk adds and updates features and functions regularly to keep pace with innovation and reduce risk. If you have Splunk Cloud Platform, these updates are released continually and you can read about recent changes in the Frequently Asked Questions section of this article. But with Splunk Enterprise on-premises, many companies have a policy to wait a few releases before upgrading any software to make sure that new features are stable. Waiting that long means the company then only has a year before that version moves out of support.
The software support policy for Splunk Enterprise is two years. For on-premises customers, Splunk releases two levels of software updates to Splunk Enterprise:
- Major "x." and Minor "x.x" releases include new and updated features and functions, updated platform elements, and cumulative bug fixes. Splunk issues major and minor releases on average twice per year.
- Maintenance "x.x.x" releases include bug fixes and minor updates within a major release interval. Splunk issues maintenance releases several times per year.
On-premises customers benefit from the continual updates to Splunk Cloud Platform because features, functions, and updates are thoroughly road-tested and hardened when they are released in a major version update.
Considerations for upgrading
Version compatibility: What works with what?
During upgrade planning, one of the first things to check is the compatibility of your Splunk premium apps and forwarders with your Splunk Enterprise destination version. Bookmark and use the Splunk versions compatibility matrix - a single place where you can look up which versions work together.
The following table shows compatibility between different forwarder and deployment server versions.
| Forwarder version | Splunk Enterprise deployment server version |
|---|---|
| 7.x | 9.x |
| 8.x | 9.x |
| 9.x | 9.x |
Pitfalls: What can cause problems during an upgrade?
You will find a list of all major pitfalls and considerations listed in About Upgrading READ THIS FIRST in the Splunk Enterprise Installation Manual, including:
- Changes that can potentially break Splunk Enterprise installations
- Occurrences that appear as problems but are normal
- Considerations for changed or removed features
- Considerations for new features
If you need help to support your organization through an upgrade, you can contact experts in Professional Services who can help you at any point. You can learn more about Splunk's technical advisory options through our Customer Success webpages.
Order of operations: What is the upgrade process?
Learn about the process with the comprehensive General process to upgrade Splunk Enterprise diagram on Splunk Answers that gives a high-level overview of how to plan and execute a Splunk Enterprise upgrade. The graphic includes where apps and add-ons fit in, when to upgrade forwarders, and links to documentation topics that explain what to do. This general process works for all Splunk Validated Architectures - just skip the components that aren't relevant to your deployment.
When you are ready to begin, follow the steps laid out in Splunk Documentation for upgrading to the latest Splunk Enterprise version: How to Upgrade Splunk Enterprise.
You can check in with your Splunk account team to have them validate your upgrade plan and help you fine-tune it. Need help with planning this upgrade? Engage OnDemand Services directly to run an "Upgrade Readiness Assessment" task or "Ask an Enterprise Expert" general consultative task to clarify questions you may have. Most customers have access to ODS per their license support contract. If you cannot open a request or do not know if you have OnDemand access, contact the ODS team at OnDemand-Inquires@splunk.com for assistance.
Best practices: What should you keep in mind during upgrade planning?
- Upgrade your on-premises Splunk Enterprise implementation as often as you can, but at least once per year. Then establish a regular upgrade cadence so you can keep pace with all major and maintenance updates Splunk releases. If you are on a later Splunk Enterprise version, maintenance updates are straightforward and non-disruptive to perform.
- If Splunk issues a maintenance release during your upgrade planning cycle, we strongly recommend that you make the latest release the target of your upgrade.
- Be proactive. Don't wait until you encounter a bug or reach the end of the version support window.
- If you have a clustered architecture, rolling upgrade features available since Splunk 7.1 have taken a lot of tedium out of regular upgrades. For details, see Perform a rolling upgrade of a search head cluster.
- Use the Upgrade Readiness App to prepare your Splunk platform deployment for upgrades to the latest version of Python, jQuery libraries etc. The Upgrade Readiness app is installed by default on Splunk Enterprise version 8.2 and higher. If you are on a Splunk Enterprise version prior to 8.2 but after 7.3, you can download the app from Splunkbase to install it on your deployment.
Next steps
- Read more about upgrades on Splunk Answers:
- Continue the discussion about Splunk Enterprise upgrades, get your questions answered and connect with your peers on Splunk Community.
- Review the following resources:
- Product Security Page. Subscribe to get notified of all recent advisories.
- Documentation. Read the detailed steps on how to take action.
- Improve Your Security Posture Tech Talk. Technical webinar focusing on our Splunk Enterprise 9.0 security features and June 2022 security advisories.
- Contact Customer Success. General contact form if you do not have your specific contact.
- OnDemand Services. Email if you cannot open a request or do not know if you have OnDemand access.