Upgrading forwarders from 4.* to 6.*: fishbucket format changes?

[Gregg Woodcock]

Somebody (Tyrone?) at the last meeting mentioned that the fishbucket format changed sometime between 4 and 6 and that it is a necessity to upgraded forwarders to 5 on the way to 6 or the fishbucket would be problematic (reset/ignored?).  I read the documentation below (and others, but this *should* be definitive) and could find no mention of this. Whoever told me this, please check out this page and then elaborate on your experience:

http://docs.splunk.com/Documentation/Splunk/6.0.2/Installation/Aboutupgradingto6.0READTHISFIRST#Upgrade_paths

[Todd Gow]

Hi Gregg, 

This is the first that I have heard of any _fishbucket changes in 6.x UF. The confusion might be that depending on your OS that you installed the UF on the initial Splunk directory did change. For instance on Windows the UF directory used to be C:\Program Files\Splunk and not it is C:\Splunk\splunkforwarder or something like that. The _fishbucket is still located in $SPLUNK_HOME/var/lib/splunk with the rest of the indexes on both the Indexer and UF. 

Regards, 

-todd

splunk> I am speed

Todd "shamgow" Gow

Sr. Inside Sales Engineer

Splunk, Inc.

Office:  +1.972.244.8753

Mobile: +1.972.955.2552

Email: tg...@splunk.com

Plano > San Francisco Cupertino  London  Hong Kong  Washington D.C.  Seattle

--

---
You received this message because you are subscribed to the Google Groups "Dallas Splunk Users Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to splunkdallas...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Tyrone Vaughn]

It was me Gregg...

I never read it in the docs. I upgraded my SearchHead/Indexers to 6.0 on release day (while we were in Vegas) and ran into some issues. While the 'lab coat adorned' were working through my update I was specifically asked if my universal forwarders were still 4.3. Some of them were and I told them as much.

It was at this point that they said there were some fishbucket changes and I should protect myself by doing 4.3->5.0->6.0.

Reading Todd's reply it might be that the support folks thought my forwarders were on windows, as my search head and indexers are, and was just trying to protect me from myself. :-)