Python 3 migration with ITSI

On January 1, 2020, Python version 2.x was officially deprecated by the Python Software Foundation. Python packages and tools have ended or are ending support for Python 2, and new Python packages don't support Python 2. To maintain compatibility with the many third party projects that use Python, Splunk has migrated Splunk Cloud Platform and Splunk Enterprise, supported Premium Solutions, and supported Splunkbase apps and add-ons to be compatible with Python 3.7.

Splunk has released Splunk Cloud Platform and Splunk Enterprise versions 8.x to support the migration from Python 2 to Python 3. Splunk has migrated impacted features to Python 3.7, and versions 8.x include both the Python 2.7 and Python 3.7 runtimes, to help customers and developers transition Python in apps from Python 2 to Python 3. Splunk will remove the Python 2.7 runtime altogether in a future release.

This page helps identify prerequisites, required changes, and steps for migrating ITSI to Python 3 alongside your Splunk Enterprise deployment. This topic covers the following upgrade scenarios:

• Migrating ITSI and Splunk Enterprise to Python 3
• Upgrading to Splunk Enterprise version 8.x with Python 2
• Upgrading to ITSI 4.4.x or later without upgrading to Splunk Enterprise version 8.x

Scenario 1: Migrate ITSI and Splunk Enterprise to Python 3

You must upgrade ITSI and all other associated add-ons to the newest versions before upgrading to Splunk Enterprise version 8.x. If you upgrade Splunk Enterprise first, ITSI breaks.

In order to upgrade to Splunk Enterprise 8.x, you must also upgrade to ITSI version 4.4.x or later. All ITSI versions prior to 4.4.x are incompatible with Splunk Enterprise version 8.x, even if you use the Python 2.7 runtime. For more information about ITSI compatibility with Splunk Enterprise, see the Splunk products version compatibility matrix.

The only post-upgrade impact for Python 3 migration relates to ITSI Predictive Analytics customers. If you currently leverage ITSI's Predictive Analytics capabilities, you must retrain all of your predictive models after you migrate ITSI to Python 3. For information about Predictive Analytics, see Overview of Predictive Analytics in ITSI.

Perform the following steps in this order to migrate ITSI to Python 3. Some steps are only required if you're using Predictive Analytics.

1. Upgrade to ITSI version 4.4.x or later

For more information, see Upgrade IT Service Intelligence on a single instance or Upgrade IT Service Intelligence in a search head cluster environment depending on your deployment architecture.

2. Upgrade the Machine Learning Toolkit

If you're using Predictive Analytics, upgrade your MLTK to version 5.0.0 or later. For ITSI version compatibility with the MLTK, see ITSI compatibility with other apps and add-ons.

3. Upgrade required add-ons

If you have an integration with ServiceNow and/or leverage ITSI's bidirectional ticketing functionality, you must upgrade the Splunk Add-on for ServiceNow and the Common Information Model (CIM) to the newest releases which are Python 3 compatible.

• Upgrade the Splunk Add-on for ServiceNow to version 5.0.x. For instructions, see Upgrade the Splunk Add-on for ServiceNow.
• Upgrade the Common Information Model to version 4.15.0. For instructions, see Install the Splunk Common Information Model Add-on.

For ITSI version compatibility with these add-ons, see ITSI compatibility with other apps and add-ons.

4. Upgrade Splunk Enterprise using the Python 3 runtime

Upgrade your Splunk Enterprise instance to version 8.x and perform the Python 3 migration. For more information, see Upgrade using the Python 3 runtime and dual-compatible Python syntax in custom scripts in the Splunk Enterprise Installation Manual.

In distributed environments, always run the same Python version on both indexers and search heads.

5. Retrain Predictive Analytics models

If you're using Predictive Analytics, confirm that data ingested to train any predictive models is still stored in Splunk software. If data has exceeded retention timeframes, re-ingest the data to feed the models.

Retrain all predictive models saved into each of your services. Retraining a model automatically replaces the existing model. For instructions, see Retrain a predictive model in ITSI.

Scenario 2: Upgrade to Splunk Enterprise 8.x with Python 2

If you upgrade to Splunk Enterprise version 8.x but want to use the Python 2 runtime, you still need to upgrade ITSI to version 4.4.x or later. However, you must use a pre-5.0.0 version of the Machine Learning toolkit.

1. Upgrade Splunk Enterprise using the Python 2 runtime

Upgrade your Splunk Enterprise instance to version 8.x using the Python 2 runtime. For more information, see Upgrade using the Python 2 runtime and make minimal changes to Python code in the Splunk Enterprise Installation Manual.

2. Upgrade to ITSI version 4.4.x or later

For more information, see Upgrade IT Service Intelligence on a single instance or Upgrade IT Service Intelligence in a search head cluster environment depending on your deployment architecture.

3. (Optional) Upgrade required add-ons

The Splunk Add-on for ServiceNow and the Common Information Model (CIM) can remain on older versions, or you can upgrade them if needed. For ITSI compatibility with these add-ons, see ITSI compatibility with other apps and add-ons.

Scenario 3: Upgrade to ITSI 4.4.x or later without Splunk Enterprise 8.x

ITSI version 4.4.x and later supports both the Python 2.7 and Python 3.7 runtimes. Therefore, you can upgrade to ITSI 4.4.x or later while still remaining on Splunk Enterprise versions 7.2.x - 7.3.x. For ITSI compatibility with Splunk Enterprise, see Splunk Enterprise system requirements.

The Splunk Add-on for ServiceNow and the Common Information Model (CIM) can remain on older versions, or you can upgrade them if needed. For ITSI compatibility with these add-ons, see ITSI compatibility with other apps and add-ons.

Do not upgrade the Machine Learning Toolkit to version 5.0.0. Version 5.0.0 is only compatible with Python 3.

Upon startup, you might encounter errors stating you have an invalid Python version. You can ignore these warnings as they have no impact on functionality. Once you upgrade to Splunk Enterprise version 8.0.0 or later the warnings no longer appear.