Scan a Splunk platform instance with the Splunk Platform Upgrade Readiness App
To run scans, you need write permissions to the Splunk Platform Upgrade Readiness App. See Manage permissions for the Splunk Platform Upgrade Readiness App.
Ensure you have taken performance factors into consideration. See Install the Splunk Platform Upgrade Readiness App.
To scan your Splunk platform instance with the Splunk Platform Upgrade Readiness App in Splunk Web, do the following:
- Launch the Splunk Platform Upgrade Readiness App.
- Click Run New Scan.
- Select which apps to scan. You can scan private apps, Splunkbase apps that you extended with your own customizations, all apps, or a custom selection of apps. Private apps include any apps not found on Splunkbase, such as apps that you created.
- Review the results of the scan for each app.
- (Optional) Export your scan results by clicking Export Results. You can choose to export in either JSON or CSV format.
You can also run scans using the REST API. See REST API endpoint reference for the Splunk Platform Upgrade Readiness App.
Some Splunk apps are too large to scan. If you cannot scan a Splunk app, follow the app's documentation for updates on Python 3 readiness.
Act on scan results
Review and act on the scan results for all your private apps. Private apps are apps that are private to your organization and not available on Splunkbase.
Resolve blocking issues in your private apps and your customized Splunkbase apps, if any, as these will block successful upgrade to the Splunk Enterprise Python 3 release. Check all other file paths flagged by the app and determine what actions to take to make them upgrade ready.
If one or more checks in an app is marked "SKIPPED", this means that the Upgrade Readiness App wasn't able to complete the check due to the way the app is packaged. You can repackage the app using the Splunk Packaging Toolkit and run the scan again, or check for the upgrade compatibility issues manually. See Overview of the Splunk Packaging Toolkit on the Splunk developer portal for more information.
Apps that are compatible with Splunk Enterprise 8.0 and later, and Python 3, are marked "PASSED", and you don't need to take any further action. If you have a version of an app that is not compatible with Splunk Enterprise 8.0 and later and Python 3, but a compatible version is available, the scan results direct you to download that version from Splunkbase to pass the check.
Remove Advanced XML
Advanced XML has been deprecated since Splunk platform version 6.3.0. If the scan identifies use of Advanced XML in your app, locate the file path containing the Advanced XML and rewrite the file to use Simple XML. For information about building dashboards and other visualizations using Simple XML, see Editing Simple XML in the Splunk Enterprise Dashboards and Visualizations manual.
Disable Splunk Web legacy mode
Splunk Web legacy mode has been deprecated since Splunk platform version 6.4.0. Set
appServerPorts to a non-zero value in
web.conf, because a zero value no longer triggers Splunk Web to operate in legacy mode in the Splunk Enterprise Python 3 release. For more information about this setting, see web.conf in the Splunk Enterprise Admin Manual.
Rename files named test.py
In Python 3,
test.py is a reserved file name. Rename any files named
test.py to a non-reserved file name to avoid file name conflicts.
Remove dependency on the M2Crypto and Swig libraries
The M2Crypto and Swig packages and their dependencies have been removed from Splunk Enterprise version 8.0 and later. Incorporate the libraries into your apps as needed, or remove all dependencies on these libraries.
Update Mako templates
In the Splunk Enterprise Python 3 release, some app server components of Splunk Web will use the Python 3.7 interpreter. Update all Mako templates to be Python 3 compatible so they will work on Splunk Web in the new release. If you want the app to continue to work on previous Splunk platform releases, make the syntax dual compatible with Python 2 and 3. If your organization requires you to remove Python 2 syntax completely by a certain schedule, you can rewrite the Mako templates to use dual-compatible syntax as an intermediate step during your upgrade process, then rewrite them to use Python 3 syntax at a later time.
Update CherryPy endpoints
In the Splunk Enterprise Python 3 release, some app server components of Splunk Web will use the Python 3.7 interpreter. Update all CherryPy endpoints to be Python 3 compatible so they will work on Splunk Web in the new release. If you want the app to continue to work on previous releases, make the syntax dual compatible with Python 2 and 3. If your organization requires you to remove Python 2 syntax completely by a certain schedule, you can rewrite them to dual-compatible syntax as an intermediate step during your upgrade process, then rewrite them to Python 3 syntax at a later time.
Update all other Python files
The Splunk Enterprise Python 3 release will include interpreters for both Python 2 and 3. In that release, for all Python code not dependent on Splunk Web or the app server, Splunk platform administrators can choose to use either interpreter by default and on a script-by-script basis. In a later release, Splunk plans to remove the Python 2 interpreter.
As a best practice, update Python files in your apps to be compatible with both Python 2 and 3 so that they are backwards compatible with previous releases, compatible with either Python interpreter in the Splunk Enterprise Python 3 release, and compatible with future releases when the Splunk platform removes the Python 2 interpreter. If your organization requires you to remove Python 2 syntax completely by a certain schedule, rewrite them using Python 3 syntax.
To make Python scripts dual compatible, use a Python 2/3 compatibility utility such as six, provided by the Python Software Foundation. For more about the six library, see https://pypi.org/project/six/.
If the upgrade readiness app identifies one or more Python scripts that are used in scripted alerts, convert those scripted alerts to custom alert actions. Scripted alerts are deprecated and might not work in future releases of the Splunk platform. For more information about custom alert actions, see Create custom alert actions for Splunk Cloud Platform or Splunk Enterprise in the Developer Guide on the Splunk Developer Portal.
What to do with scan results for Splunk-supported and third-party apps
The Splunk Platform Upgrade Readiness App scan results include Splunk-supported apps and third-party apps supported by partners and developers. App owners are responsible for updating their apps and releasing new versions that meet these upgrade readiness requirements in order to support the Splunk Enterprise Python 3 release.
If you've extended an app or customized anything locally, review the results for any custom file paths that you've added to that app and take action on those to prepare for upgrade. Otherwise, you can wait for the app owner to make updates.
For third-party apps, you can contact the developer directly using their contact details on Splunkbase to learn more about their upgrade plans. If the developer does not plan to update the app, you can make the updates yourself using the guidance in the scan checks.
Dismiss file paths
The Upgrade Readiness App allows you to dismiss file paths from the scan results. Dismiss files that you have verified are already Python 3 compatible so that you can narrow the list to files that still need your attention.
When you dismiss a file path, it removes it from all future scan results.
If you dismiss a path by accident and want to reinstate it in future scans, delete the Splunk Platform Upgrade Readiness App from your Splunk platform instance and then reinstall it.
Manage permissions for the Splunk Platform Upgrade Readiness App
REST API endpoint reference for the Splunk Platform Upgrade Readiness App
This documentation applies to the following versions of Splunk® Platform Upgrade Readiness App: 2.1.0, 2.2.0
Feedback submitted, thanks!