Upgrade

Upgrade from version 25.10 to 26.04

Upgrade the application in Splunk Enterprise or Splunk Cloud, then upgrade the collectorfordocker image to version 26.04.X.

Upgrade from version 5.24 to 25.10

Upgrade the application in Splunk Enterprise or Splunk Cloud, then upgrade the collectorfordocker image to version 25.10.X.

Upgrade from version 5.23 to 5.24

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.22 to 5.23

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.21 to 5.22

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.20 to 5.21

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.19 to 5.20

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.18 to 5.19

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.17 to 5.18

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.16 to 5.17

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.15 to 5.16

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.14 to 5.15

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.12 to 5.14

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.11 to 5.12

Upgrade the Splunk application and collectorfordocker. Monitoring Docker 5.12 is backward compatible with the previous collectorfordocker version.

input.system_stats now has dedicated disabled, type, and output values — Collectord still accepts the unified values from previous configurations for backward compatibility. The application adds two new macros, macro_docker_stats_host and macro_docker_stats_cgroup, both of which depend on macro_docker_stats so existing overrides keep working. Several inputs also gained new types, including input.system_stats, input.proc_stats, and input.net_stats.

Upgrade from version 5.10 to 5.11

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.9 to 5.10

Upgrade the Splunk application and collectorfordocker.

Upgrade from version 5.8 to 5.9

Upgrade the Splunk application and collectorfordocker. The release notes cover the new features, including streaming API Objects and support for multiple Splunk clusters.

Upgrade from version 5.7 to 5.8

Upgrade the Splunk application and collectorfordocker. No configuration changes required.

Upgrade from version 5.6 to 5.7

Upgrade the Splunk application and collectorfordocker. This release adds an input.journald input — see configuration.

If journald is enabled and you’re also forwarding /var/log/messages or /var/log/syslog, you’ll end up indexing host logs twice. To avoid that, disable rsyslog (or whatever else is writing to those files) and tell Collectord where to start reading journald from:

1--env "COLLECTOR__JOURNALD_START=input.journald__startFromRel=-1h" \

To turn off the journald input entirely:

1--env "COLLECTOR__JOURNALD_DISABLED=input.journald__disabled=true" \

Upgrade from version 5.5 to 5.6

Upgrade the Splunk application and collectorfordocker. The ConfigMap has a few new pieces — only add them if you plan to use them:

1. Under [input.files:*], the new samplingPercent and samplingKey keys enable sampling.

2. The [output.splunk] output can now cap the number of events per payload via the events key.

Upgrade from version 5.4 to 5.5

Upgrade the Splunk application and collectorfordocker. No configuration changes required.

Upgrade from version 5.3 to 5.4

Upgrade the Splunk application and collectorfordocker. No configuration changes required.

Upgrade from version 5.2 to 5.3

Version 5.3 is a minor upgrade — bump the Splunk application and the image. The configuration adds one new key, group, under [input.net_socket_table], which can significantly reduce licensing costs for network socket table data.

Upgrade from version 5.1 to 5.2

Version 5.2 is a minor upgrade with performance and usability improvements, plus forwarding of Docker and Kubelet runtime storage metrics (one extra event per host every 30 seconds). For details, see the Release History.

Mount metrics live under input.mount_stats. If you override indexes per data type, update those overrides for the new metrics too.

This release also introduces the devnull output for disabling log or metric collection on specific containers.

Version 5.2 ships predefined alerts that help monitor cluster health and application performance.

Upgrade from version 5.0 to 5.1

Version 5.1 is a minor upgrade with performance and usability improvements, plus network metrics forwarding. For details, see the Release History.

Network metrics are defined under input.net_stats (metrics) and input.net_socket_table (network connection table). If you override indexes per data type, update those overrides for the new metrics too.

Upgrade from version 3 to 5

1. Upgrade application

Download version 5 from SplunkBase and upgrade it in Splunk. Or perform in-place upgrade if you have downloaded our application from the app browser in Splunk.

2. Upgrade collector

Upgrade collectord in your configuration (compose file or any other way you deploy collectord) to latest version outcoldsolutions/collectorfordocker:26.04.1.

Update your configuration:

• Since version 5 we map docker root folder (/var/lib/docker/:/rootfs/var/lib/docker/) instead of containers folder (/var/lib/docker/containers/:/rootfs/var/lib/docker/containers/). This change allows us to auto-discover application logs.
• Since version 5 we map all host folders under /rootfs inside the container. Verify how you map the folders, compare to our Installation instructions.
• Since version 5 the default configuration file located in /config/001-general.conf instead of /config/collector.conf. If you used to override the configuration, please read the configuration page and update your configuration files.