Upgrade - Monitoring Docker | Outcold Solutions

If you get stuck, or want a hand planning an upgrade, contact support: we’ll help and guide you through it. The sections below cover what each release asks of an upgrade, newest first.

Always upgrade the Splunk app first and Collectord afterward. The Splunk app is backward compatible with previous Collectord versions.

Upgrade from version 26.04 to 26.10

Version 26.10 brings together work we started in 2019 that kept waiting on other changes. Dashboards read either the events index or a Splunk metrics index, and they lead you to what needs fixing instead of only showing state. Each team creates the alerts for its own clusters from the Alert Catalog.

We held each new input and field to what it adds to your license, and an upgrade keeps sending your data where it goes today.

Upgrade the application in Splunk Enterprise or Splunk Cloud first, then the collectorfordocker image.

Upgrade the Splunk app

Upgrade the app from Splunkbase, or with Install app from file and Upgrade app checked. Splunk doesn’t need a restart. Your macros and other changes in local/ stay. Then finish the app’s setup:

Choose the dashboards. Until an administrator (the admin or sc_admin role) does this once, every dashboard shows Splunk’s “App configuration” page. Select Continue to app setup page there (later, Setup > Configuration), and choose the events-index or the metrics-index dashboards. Collectord keeps sending its stats to the events index unless you change it, so the events-index dashboards are the choice for a drop-in upgrade.
Check the legacy alerts before you finish. The Legacy alerts section should start with “Upgrading”: the alerts that shipped with earlier versions then stay as they are. The page recognizes an upgrade by this app’s alerts having run before, at least an hour before the upgrade. If it reads “New install”, finishing the setup switches the old alerts off, so switch them on there first.
Pick the new alerts. First set Alert Catalog: who sees the alerts on the Configuration page: until you do, an alert you create from the catalog is private to you, while the old ones are shared with everyone. The old alerts keep running, marked deprecated, and a later release removes them. Pick their replacements on Setup > Alert Catalog, where each template’s More names the old alert it replaces.
Retire the old alerts. In the Legacy alerts section, switch the old ones off, or choose “Keep as my own copies” to keep them past their removal.

On a search head cluster, choose the dashboards once per member, or ship local/app.conf with [install] is_configured = 1 from the deployer.

Version 26.10 can send every stats input to a Splunk metrics index too: Metrics index compares the two and shows how to move without a gap.

If you already send Prometheus metrics to a metrics index (indexType = metrics, or a container’s collectord.io/prometheus.<N>-indexType=metrics label), the records now arrive packed and with dotted dimension names (metric.label.<label>, docker.container.name). Searches written against the old dimensions need the new names: see Metrics index.

What the upgrade changes in your data

Host logs stop arriving twice. Collectord no longer reads /var/log/syslog and /var/log/messages, which rsyslog writes from the journal, so host logs stop arriving twice. Searches of your own on those sources find nothing new after the upgrade. A host without systemd has no journal, so turn [input.files::syslog] on there: see Host logs.

Upgrade collectorfordocker

Collectord keeps its state, including how far it has read every log, in the collector_data volume, so a new container on the same volume continues where the old one stopped.

docker run: pull the new image, stop and remove the container, and start it again with your docker run command on the new tag:

bash

1docker pull registry.outcold.solutions/outcoldsolutions/collectorfordocker:26.10.1
2docker stop collectorfordocker && docker rm collectorfordocker

Docker Compose: change the image tag in your docker-compose.yaml and run docker compose up -d.
Docker Swarm: change the image tag in your docker-compose.yaml and deploy the stack again with docker stack deploy --compose-file ./docker-compose.yaml collectorfordocker. Swarm replaces Collectord’s task on every node. Upgrade the managers that run Collectord outside the stack the docker run way.
With Compose and Swarm, edit only the tag and keep your file’s volumes: section: the 26.10 file on the installation page names the volume collector_data, while yours uses the volume Compose or Swarm prefixed with the project or stack name, and that volume holds Collectord’s state.
Podman: with podman run, the same way as docker run. With Quadlet, change the tag on the Image= line, then run systemctl daemon-reload and systemctl restart collectorforpodman.service.
Your own image: if you built one on top of ours (see Configuration), change its FROM line to the new version and rebuild it.

The 26.10 commands pull from registry.outcold.solutions. Docker Hub has the same image as outcoldsolutions/collectorfordocker, so a command that pulls from there needs only the new tag.

Check the upgrade

docker exec collectorfordocker /collectord verify (with Compose, docker compose exec collectorfordocker /collectord verify) reports every check OK, and the app’s Collectord usage page lists the host on 26.10. The dashboards show the data from before the upgrade and after it, and container logs continue where they stopped. The new dashboards check more than the old ones did, such as whether a host’s clock is synced, so a host can show a warning it didn’t show before: that is the host, not the upgrade.

Upgrade from version 25.10 to 26.04

Upgrade the application in Splunk Enterprise or Splunk Cloud, then upgrade the collectorfordocker image to version 26.04.X.

Upgrade from version 5.24 to 25.10

Upgrade the application in Splunk Enterprise or Splunk Cloud, then upgrade the collectorfordocker image to version 25.10.X.

Upgrade from version 5.23 to 5.24

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.22 to 5.23

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.21 to 5.22

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.20 to 5.21

Upgrade the Splunk application and collectorfordocker.

Upgrade from an older version

If you run a version before 5.20, contact support: we’ll help you plan the upgrade and guide you through it.