Migrate a Splunk SOAR (On-premises) install from RHEL 8 to RHEL 9

Support for Red Hat Enterprise Linux 9 (RHEL) was added with the release of Splunk SOAR (On-premises) version 6.4.0. This topic provides a high-level overview of the process for migrating your Splunk SOAR (On-premises) host's operating system to RHEL 9.

Note: This article focuses on the current Splunk SOAR (On-premises) release. You can upgrade to any Splunk SOAR (On-premises) release 6.4.0 or higher.

Operating system upgrade or migration checklist

Use this table as a guide to migrating or upgrading your Splunk SOAR (On-premises) host or cluster node hosts to Red Hat Enterprise Linux 9.

To upgrade a Splunk SOAR (On-premises) cluster, see Upgrade the operating system for Splunk SOAR (On-premises) clusters.

Prerequisites:

  • Already installed or upgraded to SOAR (On-premises) 6.4.0 or higher

  • Red Hat Enterprise Linux 8 installed

Step Description
1 Make a full backup of your existing Splunk SOAR (On-premises) host or cluster. See Splunk SOAR (On-premises) backup and restore overview.
2 Upgrade your Splunk SOAR (On-premises) hosts to Red Hat Enterprise Linux 9. See the article Upgrading from RHEL 8 to RHEL 9 on the Red Hat site.
3 After you have upgraded your Splunk SOAR (On-premises) hosts to Red Hat Enterprise Linux 9, upgrade Splunk SOAR (On-premises) packages for the new operating system.
  1. Download the correct installation TAR file for your new operating system. For example, if you were on Splunk SOAR (On-premises) version 7.0.0 on Red Hat Enterprise Linux 8, download the Red Hat Enterprise Linux 9 install package for SOAR version 7.0.0. See Get Splunk SOAR (On-premises).
  2. Update Splunk SOAR (On-premises) with the correct packages and updates for the new operating system. See Upgrade Splunk SOAR (On-premises) packages for your new operating system.

Upgrade Splunk SOAR (On-premises) packages for your new operating system

After you have upgraded the operating system on your Splunk SOAR (On-premises) deployment in place, run the upgrade for Splunk SOAR (On-premises) to apply operating system dependent updates.

For clustered deployments, see the next section, Upgrade the operating system for Splunk SOAR (On-premises) clusters

  1. Download the Splunk SOAR (On-premises) installation TAR file for your new operating system. See Get Splunk SOAR (On-premises).
  2. Extract the TAR file you downloaded into the Splunk SOAR (On-premises) installation directory.
    CODE 
    tar -xvf <installer>.tgz -C <$PHANTOM_HOME>
  3. Re-run the install script using the --dist-upgrade option.
    CODE 
    <$PHANTOM_HOME>/splunk-soar/soar-install --dist-upgrade
    CAUTION: Before you can use the --dist-upgrade option, you must have already upgraded Splunk SOAR (On-premises) to release 6.4.0 or higher.

Upgrade the operating system for Splunk SOAR (On-premises) clusters

There are two methods you can use to upgrade the operating system on a Splunk SOAR (On-premises) cluster.

Each method requires that your nodes are using Splunk SOAR (On-premises) version 6.4.0 or higher.

  • Upgrade the operating system for each cluster node.
  • Create new Splunk SOAR (On-premises) nodes for your cluster on the desired operating system, add them to your cluster, then decommission nodes running the previous operating system.

Upgrade the operating system for each Splunk SOAR (On-premises) cluster node

This method converts and upgrades the operating system on your Splunk SOAR (On-premises) deployment for clusters in place.

Prerequisite: All cluster nodes using Splunk SOAR (On-premises) release 6.4.0 or higher.

To upgrade cluster nodes in a rolling fashion, follow these steps.

Perform the complete sequence of steps for one cluster node, then repeat the sequence for each additional cluster node.

  1. Upgrade the installed operating system from RHEL 8 to RHEL 9, following Red Hat's instructions for upgrading RHEL 8 to RHEL 9. See Upgrading from RHEL 8 to RHEL 9 on the Red Hat site.
  2. Download the Splunk SOAR (On-premises) installation TAR file for your new operating system, and copy it to each cluster node. See Get Splunk SOAR (On-premises).
  3. Extract the TAR file you downloaded into the Splunk SOAR (On-premises) installation directory.
    CODE 
    tar -xvf <installer>.tgz -C <$PHANTOM_HOME>
  4. Re-run the install script using the --dist-upgrade option.
    CODE 
    <$PHANTOM_HOME>/splunk-soar/soar-install --dist-upgrade
    CAUTION: Before you can use the --dist-upgrade option, you must have already upgraded Splunk SOAR (On-premises) to release 6.4.0 or higher.

Upgrade the Splunk SOAR (On-premises) cluster by adding and removing cluster nodes

Upgrade your cluster by building new cluster nodes, adding them to your cluster, then decommissioning cluster nodes running earlier versions of Splunk SOAR (On-premises). For information on adding or removing cluster nodes from your Splunk SOAR (On-premises) cluster, see Add or remove a cluster node from Splunk SOAR (On-premises).