uberAgent

Upgrading uberAgent

July 23, 2024

Contributed by:

This document describes the procedure to upgrade uberAgent to a newer version.

Note

Securing the Configuration Directory

Please see this document for important information about the need to secure the agent’s %ProgramData% configuration directory.

Understand What’s New and Changed

Please read the changelog. Changes might affect uberAgent’s configuration, for example.

Depending on the nature of the changes made for a new version, it may be necessary to update custom apps that make use of the data collected by uberAgent.

Splunk Apps

Upgrade Procedure

Delete the uberAgent app directories:

$SPLUNK_HOME\etc\apps\uberAgent
$SPLUNK_HOME\etc\apps\uberAgent_ESA
$SPLUNK_HOME\etc\apps\uberAgent_indexer
<!--NeedCopy-->

Install the new versions of the Splunk apps as described here.

Restart Splunk.

Upgrade from uberAgent 6.0

With uberAgent 6.1, the experience score data was moved from the KV store to a dedicated index. If you’re upgrading from 6.0 to a newer version, delete the Splunk KV store lookup lookup_hostinfo2 and associated data by running the following Splunk searches:

| outputlookup lookup_hostinfo2

| outputlookup lookup_score_per_machine

| outputlookup lookup_score_historic_per_machine

| outputlookup lookup_score_per_session

| outputlookup lookup_score_historic_per_session

| outputlookup lookup_score_per_application

| outputlookup lookup_score_historic_per_application
<!--NeedCopy-->

Endpoint Agents

Upgrade uberAgent’s endpoint agent by running the newer version’s installer. It detects an existing installation and uninstalls it automatically before installing the updated version. Please see the agent installation docs for deployment information (Windows, macOS).

Note: Customizations to the configuration in the installation directory are not retained during an upgrade. Such customizations must be re-applied after the upgrade. We recommend storing the configuration files outside the installation directory.

User & Host Tags

Starting with uberAgent 7.0, host and user tags are collected through dedicated timers (instead of a static interval as in previous versions). Please adjust your configuration and implement a timer for user & host tags as described here.

Elasticsearch

New uberAgent versions generally come with additional fields. This makes it necessary to update the index template. To do that, overwrite the existing index template with the new version. Please note that templates are applied to new indexes only. Existing indexes keep their templates.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Upgrading uberAgent

July 23, 2024

Contributed by:

July 23, 2024

Contributed by:

Upgrading uberAgent

Understand What’s New and Changed

Splunk Apps

Upgrade Procedure

Upgrade from uberAgent 6.0

Endpoint Agents

User & Host Tags

Elasticsearch

In this article