Python with Splunk Enterprise Security

Enterprise Security (ES) version 5.3.x and earlier are compatible with Python 2 only. ES version 6.0.x begins the transition to Python 3, but is not completely dual compatible with Python 2 and Python 3. ES version 6.1.x is compatible with Python 3 only.

For more information about Splunk ES, see Splunk Products Version Compatibility Matrix.

Splunk Enterprise Security version 5.3.x and Python compatibility

Splunk Enterprise Security versions 5.3.1 and earlier are not compatible with Splunk Enterprise version 8.x and Python 3.

Splunk Enterprise Security version 6.0.x and Python compatibility

Splunk Enterprise Security version 6.0.x is compatible with various versions of Splunk Enterprise 7.2.x through 8.x. The following flag is available in the ES 6.0.x specification files:

 python.version = {default|python|python2|python3}

However, this release is not completely dual Python 2 and Python 3 compatible. In Splunk Enterprise 8.x, it requires the Python 2 interpreter that ships with 8.x. Various configuration files are set python.version = python2 on purpose. If using Splunk Enterprise 8.x, do not set the python.version flags to python3 or run in strict python3 mode at this time.

Enterprise Security 6.0.x is the last major release that is compatible with Python 2 and with Machine Learning Toolkit 4.0.

Splunk Enterprise Security version 6.1.x and higher and Python compatibility

Splunk Enterprise Security version 6.1.x and higher is compatible with Splunk Enterprise version 8.x. The following flag is available in the ES 6.1.x and higher specification files:

 python.version = python3

ES 6.1.x and higher is Python 3 compatible only. Various configuration files are set python.version = python3 on purpose. Do not change these flags at this time.

ES 6.1.x and higher is compatible with Machine Learning Toolkit 5.0 and higher only. The previously generated models from MLTK 4.x are not compatible and have to be regenerated. See Update Splunk MLTK models for Python 3 for information about rebuilding models.