Upgrade Splunk PowerConnect App to Version 4.0.9
The below steps describe the upgrade of the PowerConnect App to version 4.0.9 and the required post – processing steps after the upgrade.
Upgrade Splunk App
Go to “Manage Apps”
Select “Install app from file”
Select “Choose File” and browse to saved upgrade file
Select the upgrade check box
Once complete the version will show the upgrade was successful.
REBUILDING DATA MODEL
In case there is no need to use the already indexed accelerated Data Model, the Data Model can be configured to rebuild from scratch for the specified acceleration period. Data Model can be rebuilt by the following steps:
1. On Splunk’s menu bar, Click on Settings -> Data models
2. From the list for Data models, expand the row by clicking “>” arrow in the first column of the row for the Data model for which acceleration needs to be rebuild. This will display an extra Data Model information in “Acceleration” section.
3. From the “Acceleration” section click on “Rebuild” link.
4. Monitor the status of the rebuild in the field “Status” of “Acceleration” section. Reload the page to get latest rebuild status.The rebuild can take quite some time (30 minutes in testing) and the percentage complete can be updated by using the “>”to hind and redisplay the data model information.
5. Repeat for other data models.
RUNNING LOOKUP SAVED SEARCHES
Run all the look up saved searches (which are suffixed with “-Run Once Only”) once again to fill up lookups with new events
- Account Instance – Lookup Gen – Run Once Only
- Account Source – Lookup Gen – Run Once Only
- Instance – Lookup Gen – Run Once Only
- Source – Lookup Gen – Run Once Only
- Tcode Instance – Lookup Gen – Run Once Only
- Tcode Source – Lookup Gen – Run Once Only
- Type Instance – Lookup Gen – Run Once Only
- Type Source – Lookup Gen – Run Once Only
Look ups can be rebuilt by the following steps:
a. On Splunk’s menu bar, Click on Settings -> Searches, reports, and alerts
b. In “App context”dropdown, select “SAP PowerConnect for Splunk (BNW-app-powerconnect)”from the list.
c. Select check box of “Show only objects created in this app context”
d. In the top right search box, enter “-Run Once Only”and click on search icon
e. Above list of look up saved searches should be filtered out.
f. Now for each saved search from the above list, click on “Actions” -> “Run”one by one in
Repeat for all in search criteria.
g. The saved searches will run with “All Time” time range. In case, you want to update the time
range with some lesser value stop the existing search job, change the time range and run the
NOTE: Run the saved searchesone by one to avoid concurrency issue