Splunk® SOAR (On-premises)

Release Notes

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.

Welcome to 5.3.4

If you are new to , read About in the Use manual to learn how you can use for security automation.

Early downloaders should redownload release 5.3.4.95226

In order to correct a potential race condition during upgrade, 5.3.4.95226 was re-released with an updated installer.

  • If you downloaded release 5.3.4.95226 before 7:00pm on August 31, 2022 Pacific Daylight Time you should redownload before installing or upgrading.
  • If you have already successfully upgraded to release 5.3.4.95226 you do not need to redownload.

privileged installations are deprecated

Splunk SOAR (On-premises) will remove support for privileged installations, for both new deployments or upgrades of existing deployments in a near-future release.

The 5.3.3 and 5.3.4 releases includes tools for migrating your existing deployment from a privileged deployment to an unprivileged one. These tools can be used any time after upgrading to release 5.3.3. If you need assistance to plan for migrating your deployment, contact your account team.

See Convert a privileged deployment to an unprivileged deployment in Install and Upgrade Splunk SOAR (On-premises).

What's new in 5.3.4

This release of includes the following enhancements.

Feature Description
Python 2 officially discontinued Python 2 was officially sunset by the Python Software Foundation on January 1, 2020. Splunk is removing this capability, effective immediately, due to a critical code flaw in Python 2.7.


Removing Python 2 from has the following results.

  • Playbooks and custom functions created with Python 2 are now in draft mode and cannot be run. Use the playbook conversion tool to update them to Python 3. Refer to Convert playbooks or custom functions from Python 2 to Python 3 in Python Playbook API Reference for .
  • Python 2 apps are no longer supported. You must replace them with a Python 3 version of the same or similar apps.
  • Runners for Python 2 playbooks have been removed. See Run playbooks in parallel with vertical scaling in Administer .
  • Python 3 playbooks that call a Python 2 custom function, playbook, or action will run, but these calls will fail.
  • Running an upgrade to 5.3.4 will generate a list of Python 2 items which must be updated. You can continue with the upgrade and then update the Python 2 items after the upgrade process completes.
Asset Mapper for the Visual Playbook Editor Enables you to map missing assets when importing playbooks from other environments. See Missing configurations in imported playbooks in the Build Playbooks with the Playbook Editor manual.
You can no longer install Apps using RPM files To install Apps, see Add and configure apps and assets to provide actions in Splunk SOAR (On-premises).
Last modified on 30 October, 2024
  Known issues for

This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.3.4

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters