Splunk Enterprise Security

How to run Splunk using python 3.7

pbankar
Path Finder

I'm developing a Technology AddOn (TA) using Modular Input and as per the latest Splunk norms they will be deprecating python 2.7. I'm using Splunk 8.

I'm making changes in the TA as per the Splunk Platform Upgrade Readiness App and need to know how do I test my TA if its running using python 3.7 or not.

On the command line, I'm getting this output:
alt text

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@pbankar

When you upgrade to version 8.0, Splunk Enterprise will continue to use the Python 2 interpreter globally by default, but Splunk Web will support only Python 3.7.

You can change python version by configuring server.conf .

Splunk Enterprise version 8.0 include a global setting, python.version, to specify which Python interpreter to use across an instance. The global setting resides in the server.conf file, located in $SPLUNK_HOME/etc/system/local/. The stanza that controls Python version is [general]

python.version is set to python2 by default in Splunk Enterprise version 8.0. To specify Python 3, set python.version = python3. These settings specify the interpreter to use if a script-level setting has not been specified, but script-level settings take precedence over the global setting, except if Python 3 is forced. 

Check Python interpreter settings in below links.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Python3Migration/ChangesEnterprise

Other Reference Link:

https://docs.splunk.com/Documentation/Splunk/8.0.0/Installation/AboutupgradingREADTHISFIRST

https://docs.splunk.com/Documentation/Splunk/8.0.0/Python3Migration/AboutMigration

Python development with Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/8.0.0/Python3Migration/PythonDevelopment

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@pbankar

When you upgrade to version 8.0, Splunk Enterprise will continue to use the Python 2 interpreter globally by default, but Splunk Web will support only Python 3.7.

You can change python version by configuring server.conf .

Splunk Enterprise version 8.0 include a global setting, python.version, to specify which Python interpreter to use across an instance. The global setting resides in the server.conf file, located in $SPLUNK_HOME/etc/system/local/. The stanza that controls Python version is [general]

python.version is set to python2 by default in Splunk Enterprise version 8.0. To specify Python 3, set python.version = python3. These settings specify the interpreter to use if a script-level setting has not been specified, but script-level settings take precedence over the global setting, except if Python 3 is forced. 

Check Python interpreter settings in below links.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Python3Migration/ChangesEnterprise

Other Reference Link:

https://docs.splunk.com/Documentation/Splunk/8.0.0/Installation/AboutupgradingREADTHISFIRST

https://docs.splunk.com/Documentation/Splunk/8.0.0/Python3Migration/AboutMigration

Python development with Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/8.0.0/Python3Migration/PythonDevelopment

Thanks

pbankar
Path Finder

Thanks, kamlesh_vaghela

0 Karma

pbankar
Path Finder

kamlesh_vaghela, I need to know one thing. to use the modular input I have to integrate the Splunklib sdk in my TA directory. How can I remove it and on runtime Splunk will resolve the

from splunklib.modularinput import *
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...