We are going to upgrade the Add-on for Windows from version 4.8.4 tot 5.0.1. while running Splunk 7.0.3 and ES 5.0.1 (these will be next to upgrade)
After going through the release notes and the upgrade info we are planning to do the following:
- Update every search/macro/knowledge object from sourcetype to source and inform users about this change
- Upgrade indexers and Search heads in the morning.
- Upgrade the different deploymentserver apps to 5.0.1 and push the app to the clients
The issue is we have a lot of deployment servers so it will take some time before all of them are updated and that servers/clients are getting version 5.0.1
My question is are we able to run 5.0.1 on search heads/indexers and 4.8.4 on the clients for a few hours without it causing any issues?
We are going through the prop files to make sure we catch any other changes in tags/eventypes or extractions, but if anyone did the upgrade and could inform us that would be very helpful.
Unfortunately we cannot test this on a test environment since we do not have any clients connected.
↧