(升级) Splunk 8.0.0 to 8.2

shenghuiping2001

已于 2022-05-26 14:47:24 修改

阅读量683

点赞数

分类专栏： splunk 文章标签： splunk upgrade

于 2022-03-26 14:26:09 首次发布

本文链接：https://blog.csdn.net/shenghuiping2001/article/details/123755175

版权

splunk 专栏收录该内容

205 篇文章 15 订阅 ¥39.90 ¥99.00

订阅专栏

超级会员免费看

本文档详细介绍了Splunk从8.0.0到8.2.7的升级过程，包括正确的升级顺序：搜索头、部署服务器、集群主节点、索引器和转发器。强调了升级过程中不同组件的兼容性，特别是指标数据的兼容性。还提供了Ubuntu系统的升级步骤，并特别注意了索引器集群中特定组件的重启超时设置。

摘要由CSDN通过智能技术生成

Splunk 版本有的有logj4的漏洞，有的splunk 开case 都不支持，所以splunk 升级变成了常见的场景：

Suggested order for the upgrade is:

1. Search heads, deployers, Deployment servers

2. Cluster master

3. Indexers

4. Forwarders.

To see if you should upgrade the forwarders before or after Indexers and rest of the components, I'd advise you to go through the compatibility matrix. In some versions, a higher version of HF/UF won't send metrix data to Indexers. That won't happen in your case (since you're upgrading from 8 to 8.2, where forwarders and Indexers are compatible with each other for both event and metrics data), so you're free to upgrade forwarders before everything or at the end.