Splunk® Platform Upgrade Readiness App

Use the Splunk Platform Upgrade Readiness App

Download manual as PDF

This documentation does not apply to the most recent version of UpgradeReadiness. Click here for the latest version.
Download topic as PDF

Scan a Splunk platform instance with the Splunk Platform Upgrade Readiness App

Prerequisites

To run scans, you need write permissions to the Splunk Platform Upgrade Readiness App. See Manage permissions for the Splunk Platform Upgrade Readiness App.

Ensure you have taken performance factors into consideration. See Install the Splunk Platform Upgrade Readiness App.

Steps

To scan your Splunk platform instance with the Splunk Platform Upgrade Readiness App in Splunk Web, do the following:

  1. Launch the Splunk Platform Upgrade Readiness App.
  2. Click Run New Scan.
  3. Select which apps to scan. You can scan private apps, Splunkbase apps that you extended with your own customizations, all apps, or a custom selection of apps.
  4. Review the results of the scan for each app.
  5. (Optional) Export your scan results in JSON format by clicking Export Results.

You can also run scans using the REST API. See REST API endpoint reference for the Splunk Platform Upgrade Readiness App.

Private apps include any apps not found on Splunkbase, such as apps that you created.

Act on scan results

Review and act on the scan results for all your private apps. Private apps are apps that are private to your organization and not available on Splunkbase.

Resolve blocking issues in your private apps and your customized Splunkbase apps, if any, as these will block successful upgrade to the Splunk Enterprise Python 3 release. Check all other file paths flagged by the app and determine what actions to take to make them upgrade ready.

If one or more checks in an app is marked "SKIPPED", this means that the Upgrade Readiness App wasn't able to complete the check due to the way the app is packaged. You can repackage the app using the Splunk Packaging Toolkit and run the scan again, or check for the upgrade compatibility issues manually. See Overview of the Splunk Packaging Toolkit on the Splunk developer portal for more information.

Remove Advanced XML

Advanced XML has been deprecated since Splunk platform version 6.3.0. If the scan identifies use of Advanced XML in your app, locate the file path containing the Advanced XML and rewrite the file to use Simple XML. For information about building dashboards and other visualizations using Simple XML, see Editing Simple XML in the Splunk Enterprise Dashboards and Visualizations manual.

Disable Splunk Web legacy mode

Splunk Web legacy mode has been deprecated since Splunk platform version 6.4.0. Set appServerPorts to a non-zero value in web.conf, because a zero value no longer triggers Splunk Web to operate in legacy mode in the Splunk Enterprise Python 3 release. For more information about this setting, see web.conf in the Splunk Enterprise Admin Manual.

Rename files named test.py

In Python 3, test.py is a reserved file name. Rename any files named test.py to a non-reserved file name to avoid file name conflicts.

Remove dependency on the M2Crypto library

The M2Crypto package and its dependencies will be removed in the upcoming Splunk Enterprise Python 3 release. Remove all dependencies on this library.

Update Mako templates

In the Splunk Enterprise Python 3 release, some app server components of Splunk Web will use the Python 3.7 interpreter. Update all Mako templates to be Python 3 compatible so they will work on Splunk Web in the new release. If you want the app to continue to work on previous Splunk platform releases, make the syntax dual compatible with Python 2 and 3. If your organization requires you to remove Python 2 syntax completely by a certain schedule, you can rewrite the Mako templates to use dual-compatible syntax as an intermediate step during your upgrade process, then rewrite them to use Python 3 syntax at a later time.

Update CherryPy endpoints

In the Splunk Enterprise Python 3 release, some app server components of Splunk Web will use the Python 3.7 interpreter. Update all CherryPy endpoints to be Python 3 compatible so they will work on Splunk Web in the new release. If you want the app to continue to work on previous releases, make the syntax dual compatible with Python 2 and 3. If your organization requires you to remove Python 2 syntax completely by a certain schedule, you can rewrite them to dual-compatible syntax as an intermediate step during your upgrade process, then rewrite them to Python 3 syntax at a later time.

Update all other Python files

The Splunk Enterprise Python 3 release will include interpreters for both Python 2 and 3. In that release, for all Python code not dependent on Splunk Web or the app server, Splunk platform administrators can choose to use either interpreter by default and on a script-by-script basis. In a later release, Splunk plans to remove the Python 2 interpreter.

As a best practice, update Python files in your apps to be compatible with both Python 2 and 3 so that they are backwards compatible with previous releases, compatible with either Python interpreter in the Splunk Enterprise Python 3 release, and compatible with future releases when the Splunk platform removes the Python 2 interpreter. If your organization requires you to remove Python 2 syntax completely by a certain schedule, rewrite them using Python 3 syntax.

To make Python scripts dual compatible, use a Python 2/3 compatibility utility such as six, provided by the Python Software Foundation. For more about the six library, see https://pypi.org/project/six/.

If the upgrade readiness app identifies one or more Python scripts that are used in scripted alerts, convert those scripted alerts to custom alert actions. Scripted alerts are deprecated and might not work in future releases of the Splunk platform. See Convert a script alert action to a custom alert action in Developing Views and Apps for Splunk Web in the Splunk Enterprise documentation, but note that the script example shown for the custom alert action has not yet been revised to demonstrate dual-compatible Python syntax.

What to do with scan results for Splunk-supported and third-party apps

The Splunk Platform Upgrade Readiness App scan results include Splunk-supported apps and third-party apps supported by partners and developers. App owners are responsible for updating their apps and releasing new versions that meet these upgrade readiness requirements in order to support the Splunk Enterprise Python 3 release.

If you've extended an app or customized anything locally, review the results for any custom file paths that you've added to that app and take action on those to prepare for upgrade. Otherwise, you can wait for the app owner to make updates.

For third-party apps, you can contact the developer directly using their contact details on Splunkbase to learn more about their upgrade plans. If the developer does not plan to update the app, you can make the updates yourself using the guidance in the scan checks.

Dismiss file paths

The Upgrade Readiness App allows you to dismiss file paths from the scan results. Dismiss files that you have verified are already Python 3 compatible so that you can narrow the list to files that still need your attention.

The option to dismiss file paths appears only if the Upgrade Readiness App cannot determine whether or not the file contains Python 2-specific syntax. Dismiss file paths from the scan results only after you have confirmed that you have taken the actions required.

When you dismiss a file path, it removes it from all future scan results.

If you dismiss a path by accident and want to reinstate it in future scans, delete the Splunk Platform Upgrade Readiness App from your Splunk platform instance and then reinstall it.

PREVIOUS
Manage permissions for the Splunk Platform Upgrade Readiness App
  NEXT
REST API endpoint reference for the Splunk Platform Upgrade Readiness App

This documentation applies to the following versions of Splunk® Platform Upgrade Readiness App: 0.1.0, 1.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters