Splunk Enterprise Security

Upgrade Splunk ES from 5.7.1 to 6.1.0 for Splunk 8.0.1: Does 6.1.0 support Python?

ibmresilient
Path Finder

Hello,

We are running Splunk 8.0.1 with Splunk ES 5.7.1 (python3 enabled). Everything works fine.

Then we just downloaded Splunk ES 6.1.0 from splunkbase.com and tried to upgrade.

Clicked "Install app from file" and pick the spl file. Once click "Upload", got an error page showing:
PR_CONNEC_RESET_ERROR.

splunkd.log shows this error

===
01-27-2020 11:00:13.984 -0500 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SA-Utils/bin/sendmsg.py", line 5, in
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: from cStringIO import StringIO
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: ModuleNotFoundError: No module named 'cStringIO'
01-27-2020 11:00:13.989 -0500 ERROR ChunkedExternProcessor - EOF while attempting to read transport header

01-27-2020 11:00:13.990 -0500 ERROR ChunkedExternProcessor - Error in 'sendmsg' command: External search command exited unexpectedly with non-zero error code 1.

Splunk ES 6.1.0 shall support python3, right?

Thanks for your help!

1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, Karma would be appreciated.

ibmresilient
Path Finder

Cool. It works!

Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...