Splunk Search

Python 2.7 present and shouldn't be

cmuesing
Explorer

I am getting an integrity check error on /opt/splunk/bin/python2.7 that says present_but_shouldnt_be. I can find the write protected file python2.7 in that path. Is this just as simple as deleting it? Is there some uninstall I need to run? 

Labels (1)
0 Karma
1 Solution

dural_yyz
Motivator

Extracting Splunk 9.3.0 on a linux build I see a file in the /opt/splunk/ called splunk-9.3.0-<buildhash>-linux-2.6-x86_64-manifest.  That file lists every directory and file along with permission codes that should exist for your install.  The integrity checks are based upon that manifest file.  If you have a 2.7 folder still inside your install you should be safe to delete it, especially if the folder has zero hidden or displayed files/folders.

View solution in original post

sadiq_aziz
Loves-to-Learn Lots

same having this issue when we upgraded to 9.2.3

looks like Splunk installation files installed python 2.7 by default

0 Karma

dural_yyz
Motivator

Extracting Splunk 9.3.0 on a linux build I see a file in the /opt/splunk/ called splunk-9.3.0-<buildhash>-linux-2.6-x86_64-manifest.  That file lists every directory and file along with permission codes that should exist for your install.  The integrity checks are based upon that manifest file.  If you have a 2.7 folder still inside your install you should be safe to delete it, especially if the folder has zero hidden or displayed files/folders.

cmuesing
Explorer

Thank you. I deleted the file and it worked great. 

computermathguy
Path Finder

We just upgraded from 9.2.2 to 9.2.3 and started getting the python integrity warnings.

 
File path                              Check result                                File path                                         Check result
/opt/splunk/bin/jp.pypresent_but_shouldnt_be/opt/splunk/bin/python2.7
present_but_shouldnt_be 
 

sampath_v
New Member

We are facing the same challenge. Did you get a solution to this issue? I have upgraded to 9.2.3 recently.

0 Karma

pmerlin1
Path Finder

Hi , same issue for me, I deleted these files : 
/opt/splunk/bin/python2.7
/opt/splunk/bin/jp.py
and i restarted Splunk
Then the messages disappeared

0 Karma

cmuesing
Explorer

We deleted Python 2.7.

0 Karma

dural_yyz
Motivator

No matter which version you upgrade to you can always reference the manifest file.  If the manifest does not list the file in the warning then it can be deleted.

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...