Scan a Splunk platform instance with the Upgrade Readiness App

Use the Upgrade Readiness App to scan a Splunk platform instance.

Prerequisites

• To run scans, a role must hold the admin_all_objects capability. See Manage permissions for the Upgrade Readiness App.
• Enable the KV store. For more information about the KV store, see About the app key value store.
• Make sure to take performance factors into consideration. See Install the Upgrade Readiness App.
• Check the size of your Splunk apps. Some apps are too large to scan. If you cannot scan a Splunk app, refer to the app's documentation for updates.

The Upgrade Readiness App no longer supports manual scans.

Steps

To scan your Splunk platform instance, follow these steps:

1. The Upgrade Readiness App automatically scans all apps daily by default. The Python scan runs at 1 AM system time, and the jQuery scan runs at 4 AM system time. Scan results appear automatically after the scan completes.
2. Review the scan results for each app in the Python and jQuery tabs.
3. (Optional) Click Export Results to export your scan results. You can choose to export in JSON format.
4. (Optional) Click Email Result to email your scan results. Make sure to configure email settings. For configuration instructions, see Configure email notifications for your Splunk platform instance.
5. Dismiss any failed files in your private applications if you want to mark it as an exception.

You can also run scans using the REST API. For more information, see the REST API reference for the Upgrade Readiness App.

Schedule a scan

The Upgrade Readiness App scans all apps daily by default. The Python scan runs at 1 AM system time, and the jQuery scan runs at 4 AM system time. The scan schedule applies to both local search heads and remote indexers.

You can modify the app scan schedule, as follows:

1. In Splunk Web, launch the Upgrade Readiness App.
2. Select either the Python or jQuery tab to modify that scheduled scan.
3. Click Manage Scan Schedule.
4. Select Scan my apps on a custom schedule, then specify the scan interval.
5. Click Save.

Disable the scan

You can disable the scan at any time, as follows:

1. Click Manage Scan Schedule.
2. Select Turn Scan Off.
3. Click Save.
   Your request is saved to the KV store, but the schedule change can take up to 2 hours to be reflected on the indexing tier.

After you disable the scan, you must explicitly enable it to rerun the scan at the defined interval. Changing the schedule in the Manage Scan Schedule dialog does not reenable the scan. Any modification to the scan schedule is reflected on indexers for remote instances and search heads for local instances after 2 hours.

Disable app list updates

The Upgrade Readiness App pulls Splunkbase apps and metadata daily 7 minutes past every eighth hour. Disabling app list updates applies to standalone instances and not to Splunk Cloud Platform. Splunk Enterprise users can disable automatic app list updates, as follows:

1. Click Settings > Data inputs > Scripts.
2. Find the pura_get_all_apps.py script in the python_upgrade_readiness_app section.
3. Click Disable.

Splunk Cloud Platform users cannot disable the script. To request that Support disable the script, submit a case using the Splunk Support Portal.

If you are running the Upgrade Readiness App in an air-gapped environment where automatic updates of the app list from Splunkbase are not possible, you can still run scans, but the app list is limited to the apps packaged with the app.