Splunk Enterprise Security

Upgrade Splunk ES from 5.7.1 to 6.1.0 for Splunk 8.0.1: Does 6.1.0 support Python?

ibmresilient
Path Finder

Hello,

We are running Splunk 8.0.1 with Splunk ES 5.7.1 (python3 enabled). Everything works fine.

Then we just downloaded Splunk ES 6.1.0 from splunkbase.com and tried to upgrade.

Clicked "Install app from file" and pick the spl file. Once click "Upload", got an error page showing:
PR_CONNEC_RESET_ERROR.

splunkd.log shows this error

===
01-27-2020 11:00:13.984 -0500 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SA-Utils/bin/sendmsg.py", line 5, in
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: from cStringIO import StringIO
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: ModuleNotFoundError: No module named 'cStringIO'
01-27-2020 11:00:13.989 -0500 ERROR ChunkedExternProcessor - EOF while attempting to read transport header

01-27-2020 11:00:13.990 -0500 ERROR ChunkedExternProcessor - Error in 'sendmsg' command: External search command exited unexpectedly with non-zero error code 1.

Splunk ES 6.1.0 shall support python3, right?

Thanks for your help!

1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

ibmresilient
Path Finder

Cool. It works!

Thank you very much.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!