Migrate a Splunk SOAR (On-premises) install from Amazon Linux 2 to Amazon Linux 2023

Support for Amazon Linux 2023 was added with the release of Splunk SOAR (On-premises) version 6.4.0. This topic provides a high-level overview of the process for migrating your Splunk SOAR (On-premises) host's operating system to Amazon Linux 2023.

Amazon does not provide an operating system upgrade package for upgrading Amazon Linux 2 to Amazon Linux 2023. Their migration method is to create a new instance using Amazon Linux 2023, deploy your application on the new host, then change the CNAMEs to point traffic to your new instance. See Migration from Amazon Linux 2 to Amazon Linux 2023 in the AWS Elastic Beanstalk Developer Guide.

Note: This article focuses on the current Splunk SOAR (On-premises) release. You can upgrade to any Splunk SOAR (On-premises) release 6.4.0 or higher.

Operating system upgrade or migration checklist

Use this table as a guide to migrating or upgrading your Splunk SOAR (On-premises) host or cluster node hosts to Amazon Linux 2023.

To upgrade a Splunk SOAR (On-premises) cluster, see Upgrade the Splunk SOAR (On-premises) cluster by adding and removing cluster nodes.

Prerequisites:

  • Already installed or upgraded to SOAR (On-premises) 6.4.0 or higher

  • Amazon Linux 8 installed

Step Description
1 Make a full backup of your existing Splunk SOAR (On-premises) host or cluster. See Splunk SOAR (On-premises) backup and restore overview.
2 Prepare a new AWS host running Amazon Linux 2023.
  1. Download the correct installation TAR file for your new operating system. See Get Splunk SOAR (On-premises).
  2. Install Splunk SOAR (On-premises) version 6.4.0 or higher on your new AWS host running Amazon Linux 2023. See Install Splunk SOAR (On-premises) as an unprivileged user.
3 Restore your backup of Splunk SOAR (On-premises) on Amazon Linux 2 to your new instance of Splunk SOAR on Amazon Linux 2023. The Splunk SOAR versions must match. See Upgrade your Splunk SOAR (On-premises) deployment on Amazon Linux 2 to a new Amazon Linux 2023 host by using backup and restore.

Upgrade your Splunk SOAR (On-premises) deployment on Amazon Linux 2 to a new Amazon Linux 2023 host by using backup and restore

This method involves creating a new Amazon Linux 2023 system for your Splunk SOAR (On-premises) and restoring your existing Splunk SOAR (On-premises) to the new host.

Prerequisites:

  • Already installed or upgraded to SOAR (On-premises) 6.4.0 or higher

  • Amazon Linux 2 installed

To create a new Amazon Linus 2023 system, follow these steps:

  1. Make a full backup of of your Splunk SOAR (On-premises) current release deployment. See Back up a Splunk SOAR (On-premises) deployment.
  2. Create a new instance of the current Splunk SOAR (On-premises) where the operating system is Amazon Linux 2023. See Install Splunk SOAR (On-premises) as an unprivileged user.
  3. Use the backup created earlier to restore the original deployment to the new deployment. See Restore Splunk SOAR (On-premises) from a backup.
  4. Update DNS CNAME records to replace your Splunk SOAR deployment on Amazon Linux 2 with your new Splunk SOAR (On-premises) deployment on Amazon Linux 2023.

Upgrade the Splunk SOAR (On-premises) cluster by adding and removing cluster nodes

If you are upgrading a Splunk SOAR (On-premises) cluster, after you have restored your backup to the new Amazon Linux 2023 host, upgrade your cluster nodes by building new cluster nodes, adding them to your cluster, then decommissioning cluster nodes running earlier versions of Splunk SOAR (On-premises). For information on adding or removing cluster nodes from your Splunk SOAR (On-premises) cluster, see Add or remove a cluster node from Splunk SOAR (On-premises).