Splunk Enterprise Security

Upgrade Splunk ES from 5.7.1 to 6.1.0 for Splunk 8.0.1: Does 6.1.0 support Python?

ibmresilient
Path Finder

Hello,

We are running Splunk 8.0.1 with Splunk ES 5.7.1 (python3 enabled). Everything works fine.

Then we just downloaded Splunk ES 6.1.0 from splunkbase.com and tried to upgrade.

Clicked "Install app from file" and pick the spl file. Once click "Upload", got an error page showing:
PR_CONNEC_RESET_ERROR.

splunkd.log shows this error

===
01-27-2020 11:00:13.984 -0500 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last):
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/SA-Utils/bin/sendmsg.py", line 5, in
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: from cStringIO import StringIO
01-27-2020 11:00:13.985 -0500 ERROR ChunkedExternProcessor - stderr: ModuleNotFoundError: No module named 'cStringIO'
01-27-2020 11:00:13.989 -0500 ERROR ChunkedExternProcessor - EOF while attempting to read transport header

01-27-2020 11:00:13.990 -0500 ERROR ChunkedExternProcessor - Error in 'sendmsg' command: External search command exited unexpectedly with non-zero error code 1.

Splunk ES 6.1.0 shall support python3, right?

Thanks for your help!

1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is not a problem with Python. It's an upload problem caused by the size of the ES app being larger than the default maximum. See the ES 6 release notes for the workaround.

---
If this reply helps you, Karma would be appreciated.

ibmresilient
Path Finder

Cool. It works!

Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...