Upgrade Splunk Asset and Risk Intelligence

Note: Splunk Asset and Risk Intelligence is not compatible with Splunk Enterprise 9.1.2 due to known issues SPL-237796, SPL-248319 where search results in "results" have more rows than expected. Upgrade to Splunk Enterprise 9.1.3 to use Splunk Asset and Risk Intelligence.

Upgrade the Splunk Asset and Risk Intelligence app by completing these high-level steps:

  1. Prerequisites
  2. Download and upgrade the app
  3. Reconfigure app settings

Prerequisites

Note: Splunk Asset and Risk Intelligence is available on Splunkbase for installation only for approved users. Contact your account manager to get access.

Before you can start an upgrade, you must deactivate the processing searches. To deactivate the processing searches, complete the following steps:

  1. In Splunk Asset and Risk Intelligence, select Admin and then Configuration settings.
  2. Select Turn all off for Process searches.

Download and upgrade the app

You can upgrade Splunk Asset and Risk Intelligence on either a Splunk Enterprise or Splunk Cloud Platform deployment. Complete the following steps based on your deployment type:

Splunk Cloud Platform

  1. From the Splunk Web menu, select Apps and then Manage apps.
  2. Locate Splunk Asset and Risk Intelligence from the list of apps.
  3. Select View details on Splunkbase and then upgrade the app through Splunkbase.
  4. Restart the search head.

Splunk Enterprise

  1. Upgrade the app using one of the following methods:
    1. Upload the new app version directly on the search head from the Splunk Enterprise home page and then overwrite the existing installation.
    2. Use Splunkbase to upgrade the app.
  2. Restart the search head.
Note: If you see any errors or warnings following the upgrade and restart of the search head, you might need to clear the cache on your browser.

Reconfigure app settings

After you upgrade the app, you must complete a few steps in Splunk Asset and Risk Intelligence to restore the appropriate functionality:

  1. Run upgrade checks.
    1. Select Admin and then Install and upgrade helper.
    2. In the Upgrade from a previous version section, select Check upgrade for each option.
    3. Run the upgrade checks to populate all of your data.
      After you complete the checks, the Check upgrade dialogue box displays "Success".
  2. Reactivate the Splunk Asset and Risk Intelligence processing searches.
    1. Select Admin and then Configuration settings.
    2. Select Turn all on for Process searches.
      Note: Due to a known issue in Splunk Asset and Risk Intelligence version 1.1.1, the processing searches for asset and IP processing fail to run after upgrading. You must complete the workaround found in

      Known issues

      after upgrading.