Act on Python scan results with the Upgrade Readiness App

After you scan your Splunk platform instance with the Upgrade Readiness App, you can review and act on the results to prepare your deployment for Python 3.

Public apps

Review and act on the scan results for all of your public apps. Public apps are apps that are available on Splunkbase.

The Upgrade Readiness App scan results of public apps include Splunk-supported apps and third-party apps supported by partners and developers. App owners are responsible for updating their apps and releasing new versions that meet the upgrade readiness requirements of the Splunk Enterprise releases that require Python 3.

If you've extended an app or customized anything locally, review the results for any custom file paths that you've added to that app and take action on those to prepare for the upgrade. Otherwise, you can wait for the app owner to make updates.

For third-party apps, you can contact the developer directly using their contact details on Splunkbase to learn more about their upgrade plans. If the developer does not plan to update the app, you can make the updates yourself using the guidance in the private scan checks.

If you have a version of a public app that is not compatible with Splunk Enterprise 8.0 and higher and Python 3, but a compatible version is available, then the scan results direct you to download that version from Splunkbase to pass the check.

The Public App status fails and displays a warning icon for any public app that does not have a version available in the splunkbase.csv list. This list is shipped with the app and updated at 7 minutes past every eighth hour in a sync to Splunkbase. In the event that a connection to Splunkbase fails, the most recent or the shipped CSV report is used in respective order as a failsafe.

Private apps

Review and act on the scan results for all of your private apps. Private apps are apps that are private to your organization and are not available on Splunkbase.

Resolve blocking issues in your private apps and your customized Splunkbase apps, if any, as these app won't work with Splunk Enterprise releases that require Python 3. Check all other file paths flagged by the app and determine what actions you must take to make them upgrade-ready.

If one or more checks in an app is marked "SKIPPED", this means that the Upgrade Readiness App wasn't able to complete the check due to the way the app is packaged. You can repackage the app using the Splunk Packaging Toolkit and run the scan again, or check for the upgrade compatibility issues manually. For more information, see Package apps for Splunk Cloud Platform or Splunk Enterprise using the Splunk Packaging Toolkit on the Splunk Developer Portal.

Apps that are compatible with Splunk Enterprise 8.0 and higher, and Python 3, are marked as PASSED. After the app is marked PASSED, test the app thoroughly to determine whether you need to take any further action.

Update Mako templates

In the Splunk Enterprise versions that require Python 3, some app server components of Splunk Web use the Python 3.7 interpreter. Update all Mako templates to be Python 3 compatible so they work on Splunk Web in the new release. If you want the app to continue to work on previous Splunk platform releases, make the syntax dual compatible with Python 2 and 3. If your organization requires you to remove Python 2 syntax completely by a certain date, you can rewrite the Mako templates to use dual-compatible syntax as an intermediate step during your upgrade process, then rewrite them to use Python 3 syntax at a later time.

Update all other Python files

In the Splunk Enterprise versions that include interpreters for both Python 2 and 3, for all Python code not dependent on Splunk Web or the app server, Splunk platform administrators can choose to use either interpreter by default and on a script-by-script basis. In a later release, Splunk plans to remove the Python 2 interpreter.

As a best practice, update Python files in your apps to be compatible with both Python 2 and 3 so that they are backwards-compatible with previous releases, compatible with either Python interpreter in the Splunk Enterprise Python 3 release, and compatible with future releases when the Splunk platform removes the Python 2 interpreter. If your organization requires you to remove Python 2 syntax completely by a certain schedule, rewrite them using Python 3 syntax.

To make Python scripts dual-compatible, use a Python 2 or 3 compatibility utility such as six, provided by the Python Software Foundation. For more about the six library, see https://pypi.org/project/six/.

If the Upgrade Readiness App identifies one or more Python scripts that are used in scripted alerts, convert those scripted alerts to custom alert actions. Scripted alerts are deprecated and might not work in future releases of the Splunk platform. For more information about custom alert actions, see Create custom alert actions for Splunk Cloud Platform or Splunk Enterprise in the Developer Guide on the Splunk Developer Portal.

Public and private apps

Review and act on the scan results with methods that apply to both public and private apps.

Python SDK check

The Upgrade Readiness App also scans for the older version of SDK in any app. Any app having a SDK with a version lower than Python 1.6.14 packaged fails.

Dismiss apps

The Upgrade Readiness App lets you dismiss an app from the scan results. Dismiss an app after you verify its Python 3 compatibility to narrow the list of apps that still require attention.

Dismissing an app marks the app as an exception, and the app is not accounted as a failure in subsequent scans. After you dismiss an app, you can still execute scans on that app and view results.

Disable email notification

The Upgrade Readiness App sends an email notification to the admin or sc_admin users, which summarizes the count of failed apps during the latest scan. The app sends this notification at 6 AM every Monday based on the Splunk system time zone. Disabling email notifications applies to standalone instances not to Splunk Cloud Platform. You can disable email notification, as follows:

1. In Splunk Web, click Settings > Data inputs > Script.
2. Search for the pura_send_email.py script in the python_upgrade_readiness_app section and click Disable.