topic Re: Will Splunk run a modular input using system Python on a Universal Forwarder in Getting Data In

Will Splunk run a modular input using system Python on a Universal Forwarder

LukeMurphey — Fri, 22 Sep 2017 07:54:32 GMT

If I have a modular input written in Python, will Splunk attempt to execute it on a Universal Forwarder if the host has Python installed?

Re: Will Splunk run a modular input using system Python on a Universal Forwarder

LukeMurphey — Fri, 22 Sep 2017 07:56:28 GMT

Yes, it will.

Splunk will invoke the system's Python interpreter and run the modular input. Splunk's libraries will not be available (e.g. you won't be able to import splunk in Python) but the the forwarder will attempt to run the input just as it would on a Splunk install that was bundled with Python.

Re: Will Splunk run a modular input using system Python on a Universal Forwarder

joshuapetitt — Tue, 17 Jul 2018 19:01:05 GMT

precisely "how" will splunk invoke the system's Python interpreter? I have python 3 and python 2 installed on the system, and the python calls python 3 because how how the PATH is setup. Can I somehow override to tell splunk which python to use?

Re: Will Splunk run a modular input using system Python on a Universal Forwarder

LukeMurphey — Tue, 17 Jul 2018 19:10:09 GMT

@joshuapetit: I don't exactly know but I will suspect that Splunk is calling the first interpreter per the PATH setup. You might want to try setting the PATH such that other interpreter is first and seeing if Splunk uses that one instead.

Re: Will Splunk run a modular input using system Python on a Universal Forwarder

joshuapetitt — Tue, 17 Jul 2018 19:11:55 GMT

Thanks for the reply, I'm trying to do that very thing. Although other parts of the system rely on python 3 being first in the PATH. Is there a way I can set the PATH variable for just the Universal Forwarder? Perhaps via a .conf file?

Re: Will Splunk run a modular input using system Python on a Universal Forwarder

LukeMurphey — Tue, 17 Jul 2018 19:32:45 GMT

You should be able to set the PATH via splunk-launch.conf.

Alternatively, it could likely be tested just by doing a local install of Splunk to see if Splunk does indeed use the PATH. In that case, you could likely just sudo to root, adjust the path and then start Splunk manually to see which Python it uses.

Re: Will Splunk run a modular input using system Python on a Universal Forwarder

joshuapetitt — Tue, 17 Jul 2018 19:40:38 GMT

I've edited the system PATH and Splunk does just call the first python that is found in the path. I'm trying now to set the path in splunk-launch.conf but am not having any success at this. I've started a new question about that here:

https://answers.splunk.com/answers/672234/splunk-universal-forwarder-how-to-set-path-environ.html