Will Splunk run a modular input using system Python on a Universal Forwarder

[LukeMurphey]

If I have a modular input written in Python, will Splunk attempt to execute it on a Universal Forwarder if the host has Python installed?

[LukeMurphey · Accepted solution]

Yes, it will.

Splunk will invoke the system's Python interpreter and run the modular input. Splunk's libraries will not be available (e.g. you won't be able to import splunk in Python) but the the forwarder will attempt to run the input just as it would on a Splunk install that was bundled with Python.

[joshuapetitt]

precisely "how" will splunk invoke the system's Python interpreter? I have python 3 and python 2 installed on the system, and the python calls python 3 because how how the PATH is setup. Can I somehow override to tell splunk which python to use?

[LukeMurphey]

@joshuapetit: I don't exactly know but I will suspect that Splunk is calling the first interpreter per the PATH setup. You might want to try setting the PATH such that other interpreter is first and seeing if Splunk uses that one instead.

[joshuapetitt]

Thanks for the reply, I'm trying to do that very thing. Although other parts of the system rely on python 3 being first in the PATH. Is there a way I can set the PATH variable for just the Universal Forwarder? Perhaps via a .conf file?

[LukeMurphey]

You should be able to set the PATH via splunk-launch.conf.

Alternatively, it could likely be tested just by doing a local install of Splunk to see if Splunk does indeed use the PATH. In that case, you could likely just sudo to root, adjust the path and then start Splunk manually to see which Python it uses.

[joshuapetitt]

I've edited the system PATH and Splunk does just call the first python that is found in the path. I'm trying now to set the path in splunk-launch.conf but am not having any success at this. I've started a new question about that here:

https://answers.splunk.com/answers/672234/splunk-universal-forwarder-how-to-set-path-environ.html