Upgrading uberAgent®
This document describes the procedure to upgrade uberAgent to a newer version.
Note
Securing the Configuration Directory
Please see this document for important information about the need to secure the agent's
%ProgramData% configuration directory.
Understand What's New and Changed
Please read the changelog. Changes might affect uberAgent's configuration, for example.
Depending on the nature of the changes made for a new version, it may be necessary to update custom apps that make use of the data collected by uberAgent.
Splunk Apps
Upgrade Procedure
Delete the uberAgent app directories:
$SPLUNK_HOME\etc\apps\uberAgent
$SPLUNK_HOME\etc\apps\uberAgent_ESA
$SPLUNK_HOME\etc\apps\uberAgent_indexer
Install the new versions of the Splunk apps as described here.
Restart Splunk.
Upgrade from uberAgent 6.0
With uberAgent 6.1, the experience score data was moved from the KV store to a dedicated index. If you're upgrading from 6.0 to a newer version, delete the Splunk KV store lookup
lookup_hostinfo2 and associated data by running the following Splunk searches:
| outputlookup lookup_hostinfo2
| outputlookup lookup_score_per_machine
| outputlookup lookup_score_historic_per_machine
| outputlookup lookup_score_per_session
| outputlookup lookup_score_historic_per_session
| outputlookup lookup_score_per_application
| outputlookup lookup_score_historic_per_application
Endpoint Agents
Note: Customizations to the configuration in the installation directory are not retained during an upgrade. Such customizations must be re-applied after the upgrade. We recommend storing the configuration files outside the installation directory.
Elasticsearch
New uberAgent versions generally come with additional fields. This makes it necessary to update the index template. To do that, overwrite the existing index template with the new version. Please note that templates are applied to new indexes only. Existing indexes keep their templates.