Splunk® Enterprise

Python 3 Migration

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Update Splunk MLTK models for Python 3

Check this manual often for updated information about the Splunk platform Python 3 migration. The content is subject to change.

Models that use Python 2 syntax should be unaffected by upgrading to Splunk Enterprise version 8.0, as the Python 2 interpreter is used by default. However, to use Python 3 syntax, you will need to update your models after Splunk Enterprise version 8.0 has been deployed. Upgrading to Splunk Enterprise version 8.1 might impact models, as the Python 3 interpreter is used by default by Splunk Enterprise version 8.1. Also, custom built models and models created with the Experiment Management Framework must be updated to work properly with Python 3.

To update models for the Python 3, in Splunk MLTK you will need to:

  • Rerun searches that feed custom models. Running searches again replaces the model.
  • Rerun the experiment workflow for any models stored in the Experiment Management Framework. Running the workflow again also replaces the model.
  • Confirm that data ingested to train any custom models is still stored in Splunk Enterprise. If data has exceeded retention timeframes, re-ingest the data to feed the model, and rebuild model workflows if necessary.
  • Recreate models including the partial_fit parameter.

For information about updating models, see the Splunk Machine Learning Toolkit.

Last modified on 06 February, 2024
Python 3 migration with ITSI   Splunk support policy

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 8.0.0, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.4, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 7.3.9, 8.0.1, 8.0.2, 8.0.3

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters