KB 035 – Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

The below steps describe the upgrade of the PowerConnect App to version 4.0.9 and the required post – processing steps after the upgrade.

Upgrade Splunk App

Go to “Manage Apps”

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

Select “Install app from file”

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

Select “Choose File” and browse to saved upgrade file

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

Select the upgrade check box

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

Select upload

Upgrade Splunk PowerConnect App to Version 4.0.9

Once complete the version will show the upgrade was successful.

Upgrade Splunk PowerConnect App to Version 4.0.9

Post Processing

REBUILDING DATA MODEL

In case there is no need to use the already indexed accelerated Data Model, the Data Model can be configured to rebuild from scratch for the specified acceleration period. Data Model can be rebuilt by the following steps:

1. On Splunk’s menu bar, Click on Settings -> Data models

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

2. From the list for Data models, expand the row by clicking “>” arrow in the first column of the row for the Data model for which acceleration needs to be rebuild. This will display an extra Data Model information in “Acceleration” section.

Upgrade Splunk PowerConnect App to Version 4.0.9

3. From the “Acceleration” section click on “Rebuild” link.

Upgrade Splunk PowerConnect App to Version 4.0.9

4. Monitor the status of the rebuild in the field “Status” of “Acceleration” section. Reload the page to get latest rebuild status.The rebuild can take quite some time (30 minutes in testing) and the percentage complete can be updated by using the “>”to hind and redisplay the data model information.

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

Upgrade Splunk PowerConnect App to Version 4.0.9

5. Repeat for other data models.

RUNNING LOOKUP SAVED SEARCHES

Run all the look up saved searches (which are suffixed with “-Run Once Only”) once again to fill up lookups with new events

  • Account Instance – Lookup Gen – Run Once Only
  • Account Source – Lookup Gen – Run Once Only
  • Instance – Lookup Gen – Run Once Only
  • Source – Lookup Gen – Run Once Only
  • Tcode Instance – Lookup Gen – Run Once Only
  • Tcode Source – Lookup Gen – Run Once Only
  • Type Instance – Lookup Gen – Run Once Only
  • Type Source – Lookup Gen – Run Once Only

Look ups can be rebuilt by the following steps:

a. On Splunk’s menu bar, Click on Settings -> Searches, reports, and alerts

Upgrade Splunk PowerConnect App to Version 4.0.9

b. In “App context”dropdown, select “SAP PowerConnect for Splunk (BNW-app-powerconnect)”from the list.

Upgrade Splunk PowerConnect App to Version 4.0.9

c. Select check box of “Show only objects created in this app context”

Upgrade Splunk PowerConnect App to Version 4.0.9

d. In the top right search box, enter “-Run Once Only”and click on search icon

Upgrade Splunk PowerConnect App to Version 4.0.9

e. Above list of look up saved searches should be filtered out.

Upgrade Splunk PowerConnect App to Version 4.0.9

f. Now for each saved search from the above list, click on “Actions” -> “Run”one by one in
new tabs

Upgrade Splunk PowerConnect App to Version 4.0.9

Repeat for all in search criteria.

g. The saved searches will run with “All Time” time range. In case, you want to update the time
range with some lesser value stop the existing search job, change the time range and run the
search again.

NOTE: Run the saved searchesone by one to avoid concurrency issue

Download PDF version here