How to upgrade hf in splunk? Is HF Upgrade is required ? Confirm that an upgrade hf is necessary because Heavy forwarders are always compatible with later versions, so it is not like that if we upgrade the indexers so we need to update HF also.

• Take Backup of files:-
Took backup of Existing Splunk named as Splunk.tar present at /new-data-storage/

• Stop the Splunk Service:-

  • Copy splunk-7.1.2-a0c72a66db66-Linux-x86_64.tgz to /new-data-storage/ 
  • Stop the splunk service through splunk user.
  • Go back to root user.

• Upgrade the Heavy Forwarder:-

  • Run this CLI $tar xzf splunk-7.1.2-a0c72a66db66-Linux-x86_64.tgz -C /new-data-storage/  
  • Do chown  $chown  -R splunk:splunk  /new-data-storage/splunk 
  • Go back to Splunk user and start splunk service and accept the license.

• Splunk upgraded successfully.

upgrade hf in splunk

If you are still facing issue regarding upgrade hf in splunk Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on 👍 Social Networks, happy Splunking >😉