uberAgent

Upgrading uberAgent

When a new version of uberAgent is available you need to do the following in order to update your existing installation.

Understand What is New and Changed

Please read the changelog. Changes might affect uberAgent’s configuration, for example.

Depending on the nature of the changes made for a new version it may be necessary to update custom apps that make use of the data collected by uberAgent.

uberAgent Splunk Indexer and Dashboard Apps

Before upgrading from version 6, delete the Splunk KV store lookup lookup_hostinfo2 by running the following Splunk search:

| outputlookup lookup_hostinfo2
<!--NeedCopy-->

Also, run the following commands one after another to delete obsolete KV Store collections of the experience scores. Starting with 6.1, scores are stored in an index.

| outputlookup lookup_score_per_machine
<!--NeedCopy-->
| outputlookup lookup_score_historic_per_machine
<!--NeedCopy-->
| outputlookup lookup_score_per_session
<!--NeedCopy-->
| outputlookup lookup_score_historic_per_session
<!--NeedCopy-->
| outputlookup lookup_score_per_application
<!--NeedCopy-->
| outputlookup lookup_score_historic_per_application
<!--NeedCopy-->

Delete the uberAgent app directories:

$SPLUNK_HOME\etc\apps\uberAgent
$SPLUNK_HOME\etc\apps\uberAgent_ESA
$SPLUNK_HOME\etc\apps\uberAgent_indexer
<!--NeedCopy-->

Install the new versions of the Splunk apps as described here.

Restart Splunk.

Starting with uberAgent 6.1, we added a second index called score_uberagent_uxm in addition to the existing index uberAgent. This is because uberAgent now uses index storage for scores on the Experience Score dashboard instead of the KV Store. So please make sure to update the uberAgent_indexer app as well.

This is especially important when using Splunk Cloud. Details are available here.

uberAgent on the Endpoints

In uberAgent 7.0, host and user tags are collected through dedicated timers instead of a static interval. Please adjust your configuration and implement a timer as described here to continue collecting user and host tags after upgrading to uberAgent 7.0.

uberAgent’s MSI installer has all the logic to upgrade an installation automatically preserving the current settings. Just run the installer again using your deployment method of choice as described here.

Note: customizations to the configuration in the installation directory are not retained during an upgrade. Such customizations must be re-applied after the upgrade. We recommend to store the configuration files outside the installation directory.

Elasticsearch

New uberAgent versions generally come with additional fields. This makes it necessary to update the index template. To do that, overwrite the existing index template with the new version. Please note that templates are applied to new indexes only. Existing indexes keep their templates.

Upgrading uberAgent