Getting Data In

Is it possible to use a Splunk Deployment Server to push out Python 2.7 to the forwarder?

BrendanMcE
Path Finder

As the splunk forwarder is missing python and relies on the OS python, could we not create an app "python2.7" on the deployment server and push this out to each host we manage, then use this version of python for running other splunk applications?
We need to get Python 2.7 out to the forwarders but the OS has version 2.6 and we do not want to replace this. The hosts also do not have access to the internet to download version 2.7. Thus build Python 2.7 on the deployment server and then push it out.

0 Karma
1 Solution

BrendanMcE
Path Finder
0 Karma

kml_uvce
Builder

yes you can do this but not recommended, you can use any other tool like puppet etc for this...

kamal singh bisht
0 Karma

lguinn2
Legend

The Splunk forwarder cannot "push out" any binary! Forwarders take in data and send it to indexers. That's it.

Even the deployment server can't manage binaries.

Sorry.

0 Karma

BrendanMcE
Path Finder

I have been able to push out some libraries and binaries from the deployment server to the forwarder by just creating and app and adding the files to this. So this looks like it should be possible. Just need to work out what is needed to get the local Python2.7 working

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...