Upgrade Atlas from 3.X to 4.0

Atlas 3.X to 4.0.0 Upgrade Steps

Note: Atlas Data Requests will be lost in the transition, as they are stored in the user directories and not in the KVStore.

1) Change Atlas 3.x to global sharing

- This will require you to set all Atlas apps sharing to global. Do this by going to "Apps>Manage Apps" and clicking permissions in the Sharing column. Select "All Apps (system)". Do this for each Atlas app.
- This allows us to backup all the data without switching app context for each query. 

2) Backup KVStores with provided SPL. All queries ran at /app/atlas_core/search (Note: this will consolidate these backups in the version 3.x atlas_core app. As an additional precaution you can also download the results of each query (using the export button and csv option) before moving on to the next one.

1) | inputlookup atlas_data_definitions | outputlookup atlas_data_definitions_backup.csv
2) | inputlookup atlas_known_forwarders | outputlookup atlas_known_forwarders_backup.csv
3) | inputlookup atlas_forwarder_systems | outputlookup atlas_forwarder_systems_backup.csv
4) | inputlookup atlas_monitor_groups | outputlookup atlas_monitor_groups_backup.csv
5) | inputlookup atlas_data_watch | outputlookup atlas_data_watch_backup.csv
6) | inputlookup atlas_data_watch_status | outputlookup atlas_data_watch_status_backup.csv
7) | inputlookup atlas_data_watch_base_searches | outputlookup atlas_data_watch_base_searches_backup.csv
8) | inputlookup atlas_acknowledged_searches | outputlookup atlas_acknowledged_searches_backup.csv
9) | inputlookup atlas_search_library_custom | outputlookup atlas_search_library_custom_backup.csv
10) | inputlookup atlas_migration | outputlookup atlas_migration_backup.csv
11) | inputlookup atlas_pca_roles | outputlookup atlas_pca_roles_backup.csv

3) Install Atlas 4.x alongside Atlas 3.x (Note: you won't be able to navigate to much of Atlas until step 6. For step 4, simply type /app/atlas/search into your Splunk URL)

4) Import KVStore Backups. All queries ran at /app/atlas/search (Note: Running these in Atlas 4.x will successfully write the 3.x backups to the 4.x KVStore)

1) | inputlookup atlas_data_definitions_backup.csv | outputlookup atlas_data_definitions
2) | inputlookup atlas_known_forwarders_backup.csv | outputlookup atlas_known_forwarders
3) | inputlookup atlas_forwarder_systems_backup.csv | outputlookup atlas_forwarder_systems
4) | inputlookup atlas_monitor_groups_backup.csv | outputlookup atlas_monitor_groups
5) | inputlookup atlas_data_watch_backup.csv | outputlookup atlas_data_watch
6) | inputlookup atlas_data_watch_status_backup.csv | outputlookup atlas_data_watch_status
7) | inputlookup atlas_data_watch_base_searches_backup.csv | outputlookup atlas_data_watch_base_searches
8) | inputlookup atlas_acknowledged_searches_backup.csv | outputlookup atlas_acknowledged_searches
9) | inputlookup atlas_search_library_custom_backup.csv | outputlookup atlas_search_library_custom
10) | inputlookup atlas_migration_backup.csv | outputlookup atlas_migration
11) | inputlookup atlas_pca_roles_backup.csv | outputlookup atlas_pca_roles

5) Remove all Atlas Element Apps and Atlas Core (Note: On a Search Head Cluster, you will need to remove these apps from the shcluster/apps directory of your deployer and reapply your bundle)

6) Setup your Atlas 4.x license and users

7) Configure Atlas 4.x on the Element Configuration Page

8) Configure Atlas Targets