topic describes how to Upgrade universal forwarders using the deployment server

​Download the Splunk Remote Upgrader for Windows Universal Forwarders from Splunkbase at​ ​​https://splunkbase.splunk.com/app/7920​.

This file contains the universal forwarder upgrader package and delivery scripts. The delivery scripts deliver a new version of the universal forwarder to an already installed universal forwarder that has an active remote upgrader installed using the deployment server. For a manual installation, you only need the universal forwarder upgrader package.​

1. Unzip the downloaded file.

2. ​ ​In the directory ​splunk_app_uf_remote_upgrade_windows​, find the universal forwarder upgrader package: splunk-upgrader-win.zip file. You can locate this file at: ​splunk_app_uf_remote_upgrade_windows/default/packages/splunk-upgrader-win.zip​ ​​.

3. You should see the directory: splunk_app_uf_remote_upgrade_windows​. ​ ​Put the universal forwarder installation package and universal forwarder signature files into the directory: ​splunk_app_uf_remote_upgrade_windows/local/packages​ ​​ ​.

4. The directory ​splunk_app_uf_remote_upgrade_windows ​ is ready to be distributed to selected universal forwarders using the deployment server. When you distribute the application using the deployment server, make sure the application and Restart agent are enabled. After the application is distributed, the universal forwarder upgrade will be performed automatically.

5. For troubleshooting, see the logs in ​./log/splunk_upgrader_upgrade.log