Skip to content

Upgrade the Splunk Add-on for NGINX

There are different upgrade instructions for different versions of the Splunk Add-on for NGINX.

Upgrade from version 2.0.2 to version 3.0.0 and higher

Splunk Add-on for NGINX from version 3.0.0 onward relies on the Python runtime bundled with Splunk Enterprise and no longer requires certain legacy Python libraries that were packaged with version 2.0.2. Architectural decisions made for Splunk Enterprise do not allow modules introduced in previous versions of the add-on to be removed automatically during upgrade. Splunk administrators must manually delete the following files and directories from the $SPLUNK_HOME/etc/apps/Splunk_TA_nginx/bin/ directory on all Splunk servers where the add-on was upgraded:

  • configparser.py
  • backports/
  • builtins/
  • future/
  • reprlib/
  • splunk_ta_nginx/
  • __pycache__/

This guarantees that the add-on uses the Python libraries bundled with Splunk Enterprise and ensures proper modular input functionality and compatibility after the upgrade.

Upgrade to version 3.0.0

  • If you are upgrading the Splunk Add-on for NGINX from a previous version to 3.0.0, you must follow the same instructions as a new install and complete all of the configuration steps from the beginning.
  • You should only upgrade if you are also upgrading (or have already upgraded) your NGINX installation to one of the compatible NGINX versions for 3.0.0.
  • If you upgrade either your NGINX product or Splunk Add-on installation without upgrading the other and completing the configuration steps, the add-on will not be able to ingest new data.

Upgrade to version 2.0.2

If you are using these versions of NGINX, use version 2.0.2 of the Splunk Add-on for NGINX:

  • NGINX Plus R8 versions 1.9.9
  • NGINX Plus R15 versions 1.13.10 (new NGINX Plus API not supported)

There are two ways to upgrade the Splunk Add-on for NGINX to version 2.0.2:

Upgrade using the authentication feature

Versions 2.0.x and later of the Splunk Add-on for NGINX include a feature to use authentication to access status endpoints, if they are configured on an NGINX Server. To use this feature, use the following upgrade steps.

  1. Log in to Splunk Web.
  2. Select Settings > Data inputs > Splunk Add-on for NGINX.
  3. Disable all Splunk Add-on for NGINX inputs.
  4. Download and install the latest version of the Splunk Add-on for NGINX from Splunkbase.
  5. Identify whether your NGINX deployment uses encrypted or unencrypted communication. See the Switch between encrypted and unencrypted communication section of this manual for more information.
  6. Configure authentication on NGINX Server. See the topic on Restricting Access with HTTP Basic Authentication in the NGINX documentation.
  7. Click on the input name and edit the Nginx URL field value to remove the http_scheme. For example, change http://127.0.0.1/status to 127.0.0.1/status
  8. (Optional) Add the NGINX username you use to access the NGINX status JSON REST interface
  9. (Optional) Add the NGINX password you use to access the NGINX status JSON REST interface
  10. Save your changes.
  11. Restart your Splunk platform instance.
  12. Enable each Splunk Add-on for NGINX input.

Upgrade using default settings

By default, all communications from version 2.0.x of the Splunk Add-on for NGINX to your NGINX servers are encrypted by using HTTPS with SSL certificate validation enabled. If you are using the nginx:plus:api input, use the following steps to upgrade from version 1.0.0 to version 2.0.x.

  1. Log in to Splunk Web.
  2. Select Settings > Data inputs > Splunk Add-on for NGINX.
  3. Disable all Splunk Add-on for NGINX inputs.
  4. Download and install the latest version of the Splunk Add-on for NGINX from Splunkbase.
  5. Identify whether your NGINX deployment uses encrypted or unencrypted communication. See the Switch between encrypted and unencrypted communication section of this manual for more information.
  6. Restart your Splunk platform instance.
  7. Log in to Splunk Web.
  8. Select Settings > Data inputs > Splunk Add-on for NGINX.
  9. Click on each input name and edit the Nginx URL field value to remove the http_scheme (For example, change http://127.0.0.1/status to 127.0.0.1/status)
  10. Save your changes.
  11. Restart your Splunk platform instance.
  12. Enable each input.