Splunk Enterprise Security

Upgrade Splunk ES from 5.7.1 to 6.1.0 for Splunk 8.0.1: Does 6.1.0 support Python?

ibmresilient
Path Finder

Hello,

We are running Splunk 8.0.1 with Splunk ES 5.7.1 (python3 enabled). Everything works fine.

Then we just downloaded Splunk ES 6.1.0 from splunkbase.com and tried to upgrade.

Clicked "Install app from file" and pick the spl file. Once click "Upload", got an error page showing:
PR_CONNEC_RESET_ERROR.

splunkd.log shows this error

===
01-27-2020 11:00:13.984 -0500 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SA-Utils/bin/sendmsg.py", line 5, in
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: from cStringIO import StringIO
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: ModuleNotFoundError: No module named 'cStringIO'
01-27-2020 11:00:13.989 -0500 ERROR ChunkedExternProcessor - EOF while attempting to read transport header

01-27-2020 11:00:13.990 -0500 ERROR ChunkedExternProcessor - Error in 'sendmsg' command: External search command exited unexpectedly with non-zero error code 1.

Splunk ES 6.1.0 shall support python3, right?

Thanks for your help!

1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

ibmresilient
Path Finder

Cool. It works!

Thank you very much.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!