All Apps and Add-ons

Splunk Upgrade Readiness app incorrectly flagging app as "Warning" level...

tmeader
Contributor

I'm running the Splunk Upgrade Readiness app 2.1 on Splunk Enterprise 7.3.3. One of the results that I'm seeing is for "Splunk Security Essentials 3.0.3" (this is the very latest version, from Splunkbase, which is labeled as certified for Splunk 😎 and it's coming back with a state of "Warning". The recommendation is:

"This app has an 8.0-compatible version available on Splunkbase. Please download this version, as the 8.0 compatible version on Splunkbase has been certified to be Python 3-compatible by the developer."

I've already done this, yet the "Check 7: Python Scripts" section of the results for the app is shown with a "Warning" status, and lists 45 python scripts in the app with issues to be remedied.

Any ideas?

0 Karma

rshah_splunk
Splunk Employee
Splunk Employee

The Splunk Upgrade Readiness App contains a static list of apps on Splunkbase. This app list doesn't contain information about the newly released Splunk Security Essentials 3.0.3 App which is dual compatible. Hence you are seeing this message. As a workaround, you can update the line 133 of $SPLUNK_HOME/etc/apps/upgrade_readiness_app/bin/libs_py2/splunksupportedapps.csv as shown below:

Splunk_Security_Essentials,Splunk Security Essentials,https://splunkbase.splunk.com/app/3435/,**3.0.3#8.0|7.3|7.2|7.1|7.0|6.6|;**3.0.2#8.0|7.3|7.2|7.1|7.0...

Once you have done this change clear the cache in your browser and rerun the scan. This time it should not scan the app as the installed app is already 8.0 compatible and the Readiness app also now has the information for this.

As far as your 2nd question is concerned this app uses various standard python fixers to detect python 2 syntaxes. So a dual compatible file can still be shown as a warning in the results. But if you are sure that the file is compatible with both python versions, you can dismiss that particular file path. Dismissing would exclude this file path from future scans. Make sure that you dismiss a file path only if you are sure as this action cannot be undone.

0 Karma

rshah_splunk
Splunk Employee
Splunk Employee

Ignore "" at the beginning and end from **3.0.3#8.0|7.3|7.2|7.1|7.0|6.6|;

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...