Deployment Architecture

Splunk Google cloud platform add-on 3.0.2 input fails with exception for 7.2.3


Hi all

Splunk Google add-on 3.0.2 input fails with exception for 7.2.3

the docs state that the add-on is supported for 7.2.3:

We have a case open, but splunk state upgrading to python 3?

however in server.conf  of 7.2.3 there is no option in the spec file to add the python switch. 

So even if we install python 3 , how do we force splunk to use it?( alternatively if will mean having to test other add-ons for compatibility also , there is the migration app I am aware.)
below setting is not available in 7.2.3  spec , it is quoted in 8.x

python.version = {python2|python3|force_python3}
* For Python scripts only, sets the default Python version to use.
* Can be overridden b

Sample of errors for inputs. 



2020-11-12 13:41:01,373 level=INFO pid=62379 tid=MainThread logger=splunksdc.collector |  | message="Modula
r input started."
2020-11-12 13:41:06,813 level=ERROR pid=62379 tid=MainThread logger=splunk_ta_gcp.modinputs.pubsub | start_t
ime=1605188461 datainput="Prod_input_testing" | message="Data input was interrupted by an unhandled exception."
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunksdc/", line 66, in wrapper
    return func(*args, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/modinputs/", line 489, in run
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/modinputs/", line 383, in run
    return self._run_consumer(subscriptions[0])
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/modinputs/", line 393, in _run_consumer
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/modinputs/", line 189, in run
    parcel = agent.pull()
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/modinputs/", line 135, in pull
    self._ttl = self._get_acknowledge_deadline()
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/modinputs/", line 168, in _get_acknowledge_de
    content = response.json()
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/3rdparty/requests/", line 897, in json
    return complexjson.loads(self.text, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/simplejson/", line 516, in loads
    return _default_decoder.decode(s)
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/simplejson/", line 374, in decode
    obj, end = self.raw_decode(s)
  File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/simplejson/", line 404, in raw_decode
    return self.scan_once(s, idx=_w(s, idx).end())
JSONDecodeError: Expecting value: line 1 column 1 (char 0)




Wondering if anyone had had similar experience..

note that the migration tool in the app fails due to future package not being available ( that is a separate issue..) it needs the future package of python 3

Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...