Upgrade Splunk ES from 5.7.1 to 6.1.0 for Splunk 8.0.1: Does 6.1.0 support Python?

[ibmresilient]

Hello,

We are running Splunk 8.0.1 with Splunk ES 5.7.1 (python3 enabled). Everything works fine.

Then we just downloaded Splunk ES 6.1.0 from splunkbase.com and tried to upgrade.

Clicked "Install app from file" and pick the spl file. Once click "Upload", got an error page showing:
PR_CONNEC_RESET_ERROR.

splunkd.log shows this error

===
01-27-2020 11:00:13.984 -0500 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SA-Utils/bin/sendmsg.py", line 5, in
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: from cStringIO import StringIO
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: ModuleNotFoundError: No module named 'cStringIO'
01-27-2020 11:00:13.989 -0500 ERROR ChunkedExternProcessor - EOF while attempting to read transport header

01-27-2020 11:00:13.990 -0500 ERROR ChunkedExternProcessor - Error in 'sendmsg' command: External search command exited unexpectedly with non-zero error code 1.

Splunk ES 6.1.0 shall support python3, right?

Thanks for your help!

[richgalloway · Accepted solution]

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

[lkutch_splunk]

https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecurity#Step_2._Install_Spl...

[ibmresilient]

Cool. It works!

Thank you very much.