Splunk Platform | Upgrading your Splunk Deployment to Python 3.9

[RichaMehta1]

Splunk initially announced the removal of Python 2 during the release of Splunk Enterprise 8.0.0, aiming to align with the latest Python versions. In our ongoing effort to stay up-to-date with the latest libraries and packages, Splunk has gradually started phasing out Python 2 from its codebase. Python 2 has already been removed from Splunk Enterprise 9.3, and starting with this version, the default Python interpreter has been upgraded from Python 3.7 to Python 3.9. Splunk Cloud has also begun the process of removing Python 2 from the remaining customer stacks, with the latest release upgrading these stacks to use Python 3.9 as the default interpreter. 

For more information on Python upgrade, please visit Python 3 Migration documentation.  

Splunk Cloud Platform Updates

Starting with Splunk Cloud Platform 9.2.2403.10x, the default Python interpreter has been upgraded to Python 3.9. 

If your Splunk Cloud Platform deployment contains outdated Python code or Splunk apps that are not yet compatible with Python 3.9, you will need to upgrade them for compatibility with Python 3.9. While there is an option to revert to the Python 3.7 interpreter, it is strongly recommended to upgrade your code and/or apps to be compatible with Python 3.9. Future releases will eventually phase out the Python 3.7 interpreter. For more information on reverting to Python 3.7, refer to the  Manage Python versions in Splunk Cloud Platform documentation.

Splunk Enterprise Platform Updates

Starting with Splunk Enterprise 9.3, the default Python interpreter has been upgraded to Python 3.9.

In Splunk Enterprise 9.3, the python.version global setting defaults to force_python3 in the server.conf file upon installation. This means that your deployment will use Python 3.9 by default. If your Splunk Enterprise applications and/or add-ons are not yet compatible with Python 3.9, you can either upgrade them for compatibility or change this setting to selectively revert apps to run on Python 3.7. It is strongly recommended to upgrade your apps to be compatible with Python 3.9. Future releases will eventually phase out the Python 3.7 interpreter. 

For more information on what different values for python.version mean, or for more details on preparing for this upgrade, please refer to Changes to Splunk Enterprise with Python3 documentation.

Developer Tips

For Developers, Splunk’s AppInspect tool  can help detect issues that would prevent your app from being compatible with Splunk Cloud. In addition, we encourage you to use the latest Splunk SDK for Python, or at least v2.0.2, which is cross-compatible with Python 3.7 and Python 3.9.

If you are moving from Python 2 to Python 3, you can use the Splunk Platform Upgrade Readiness App to check compatibility with Python 3. 

If ML models exist within your Splunk solutions, you must update ML models to support Python 3.9 as well. For more information, see Splunk IT Service Intelligence and Splunk Machine Learning Toolkit.

If you have any questions, reach out to us at
python27-eol@splunk.com via email, or
#python3-migration via Splunk User Group Slack Channel, (sign up here)
You can also contact us via Splunk Support.

Best,
Splunk Python Upgrade Team