Scan a Splunk platform instance with the Upgrade Readiness App

Use the Upgrade Readiness App to scan a Splunk platform instance.

Prerequisites

• To run scans, a role must hold the admin_all_objects capability. See Manage permissions for the Upgrade Readiness App.
• Enable the KV store. For more information about the KV store, see About the app key value store.
• Make sure to take performance factors into consideration. See Install the Upgrade Readiness App.
• Check the size of your Splunk apps. Some apps are too large to scan. If you cannot scan a Splunk app, refer to the app's documentation for updates.
• In a clustered instance, scan generate a merged report for both search heads and indexers.

Steps

In Splunk Enterprise and some Splunk Cloud deployments, you can manually run scans at any time. This option is not available on all Splunk Cloud deployment types, including the Splunk Cloud classic experience. Manual scans run on the requested local instance only and don't generate a merged report of all search heads and indexers.

To scan your Splunk platform instance for Python, jQuery, and Splunk platform compatibility, follow these steps:

1. Select Run New Scan to manually scan your local instance, if that option is available. Regardless of what type of Splunk software you use, the Upgrade Readiness App automatically scans all apps daily by default. The Python scan and the Splunk platform compatibility scan run at 1 AM system time, and the jQuery scan runs at 4 AM system time. Scan results appear automatically after the scan completes.
2. Review the scan results for each app in the Python, jQuery, and Splunk platform compatibility tabs.
3. (Optional) Click Export Results to export your scan results. You can choose to export in JSON format.
4. (Optional) Click Email Result to email your scan results. Make sure to configure email settings. For configuration instructions, see Configure email notifications for your Splunk platform instance.
5. Dismiss any failed files in your private applications if you want to mark it as an exception.

You can also run scans using the REST API. For more information, see the REST API reference for the Upgrade Readiness App.

Schedule a scan

The Upgrade Readiness App scans all apps daily by default. The Python scan and the Splunk platform compatibility scan run at 1 AM system time, and the jQuery scan runs at 4 AM system time. The scan schedule applies to both local search heads and remote indexers.

Modifications to the schedule are specific to each scan, so rescheduling one scan does not impact the schedule of the other two.

You can modify the app scan schedule, as follows:

1. In Splunk Web, launch the Upgrade Readiness App.
2. Select either the Python or jQuery tab to modify that scheduled scan.
3. Click Manage Scan Schedule.
4. Select Scan my apps on a custom schedule to specify the scan interval. While default scan times are in system time, custom scan times are in browser time. Reversions to the scheduled scan time are also in browser time.
5. Click Save.

The Upgrade Readiness app merges results from Python scans at 4 AM and 4PM, from jQuery scans at 7 AM and 7 PM, and from Splunk platform compatibility scans at 7 AM and 7PM.

Disable the scan

You can disable the scan at any time, as follows:

1. Click Manage Scan Schedule.
2. Select Turn Scan Off.
3. Click Save.
   Your request is saved to the KV store, but the schedule change can take up to 2 hours to be reflected on the indexing tier.

After you disable the scan, you must explicitly enable it to rerun the scan at the defined interval. Changing the schedule in the Manage Scan Schedule dialog does not reenable the scan. Any modification to the scan schedule is reflected on indexers for remote instances and search heads for local instances after 2 hours.

Disable app list updates

The Upgrade Readiness App pulls Splunkbase apps and metadata daily 7 minutes past every eighth hour. Disabling app list updates applies to standalone instances and not to Splunk Cloud Platform. Splunk Enterprise users can disable automatic app list updates, as follows:

1. Click Settings > Data inputs > Scripts.
2. Find the pura_get_all_apps.py script in the python_upgrade_readiness_app section.
3. Click Disable.

Splunk Cloud Platform users cannot disable the script. To request that Support disable the script, submit a case using the Splunk Support Portal.

If you are running the Upgrade Readiness App in an air-gapped environment where automatic updates of the app list from Splunkbase are not possible, you can still run scans, but the app list is limited to the apps packaged with the app.