Splunk Upgrade Readiness app incorrectly flagging app as "Warning" level...

[tmeader]

I'm running the Splunk Upgrade Readiness app 2.1 on Splunk Enterprise 7.3.3. One of the results that I'm seeing is for "Splunk Security Essentials 3.0.3" (this is the very latest version, from Splunkbase, which is labeled as certified for Splunk 😎 and it's coming back with a state of "Warning". The recommendation is:

"This app has an 8.0-compatible version available on Splunkbase. Please download this version, as the 8.0 compatible version on Splunkbase has been certified to be Python 3-compatible by the developer."

I've already done this, yet the "Check 7: Python Scripts" section of the results for the app is shown with a "Warning" status, and lists 45 python scripts in the app with issues to be remedied.

Any ideas?

[rshah_splunk]

The Splunk Upgrade Readiness App contains a static list of apps on Splunkbase. This app list doesn't contain information about the newly released Splunk Security Essentials 3.0.3 App which is dual compatible. Hence you are seeing this message. As a workaround, you can update the line 133 of $SPLUNK_HOME/etc/apps/upgrade_readiness_app/bin/libs_py2/splunksupportedapps.csv as shown below:

Splunk_Security_Essentials,Splunk Security Essentials,https://splunkbase.splunk.com/app/3435/,**3.0.3#8.0|7.3|7.2|7.1|7.0|6.6|;**3.0.2#8.0|7.3|7.2|7.1|7.0...

Once you have done this change clear the cache in your browser and rerun the scan. This time it should not scan the app as the installed app is already 8.0 compatible and the Readiness app also now has the information for this.

As far as your 2nd question is concerned this app uses various standard python fixers to detect python 2 syntaxes. So a dual compatible file can still be shown as a warning in the results. But if you are sure that the file is compatible with both python versions, you can dismiss that particular file path. Dismissing would exclude this file path from future scans. Make sure that you dismiss a file path only if you are sure as this action cannot be undone.

[rshah_splunk]

Ignore "" at the beginning and end from **3.0.3#8.0|7.3|7.2|7.1|7.0|6.6|;