Splunk 10.2 Python 3.13 for Splunk Web

Available Languages

Updated:October 1, 2026
Document ID:SPLK053252

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise 10.2 Splunk Cloud 10.2

Description

Starting with [Splunk 9.x version] Splunk Web's Python runtime was updated from 3.7 to 3.9. Unlike with splunkd, this runtime version is not selectable by system or app –level settings.

Starting in Splunk 10.2, Splunk Web and all Splunk Web extensions, like custom Mako templates and custom CherryPy Controllers, that use Python will be immediately switched over to Python version 3.13.


Investigation

A way of identifying usage of potentially-impacted custom Mako Templates does not yet exist. 

Splunk 10.2 behavior: SplunkWeb components running under Python 3.13 while splunkd defaults remain on 3.9.  

 Splunk has two different interpreter models that operate independently:

  1. splunkd-controlled interpreter model (For more information refer to article Splunk 10.2 Python 3.13 for splunkd )
  2. SplunkWeb interpreter model 

SplunkWeb interprester model controls: 

  • Web tier / appserver 

  • CherryPy controllers 

  • Mako templates 

  • Python executed inside the Web runtime 

Behavior: 

  • Does not use python.required 

  • Does not participate in the dual-interpreter model 

  • Has no per-extension-point version control 

  • Python code is executed by a Python process, not splunkd or another Python process launching a new Python process. 
    E.g. custom CherryPy controllers execute in the context of the SplunkWeb, Mako templates execute in the context of SplunkWeb     

  • Its interpreter always advances first 

These two models are not interchangeable, do not have the same guarantees, and are not governed by the same rules. 

1. SplunkWeb always moves to the new interpreter first.
In Splunk 10.2 SplunkWeb runs on Python 3.13 by design.

2. The developer guide explicitly excludes SplunkWeb 

The Python 3.13 Developer Guide states: “This developer guide does NOT specifically cover anything SplunkWeb related, including CherryPy endpoints.” 

Implications: 

  • python.required does not apply to SplunkWeb 

  • The dual-interpreter model does not apply to SplunkWeb 

  • Web-tier Python moves immediately to the newest interpreter 

 

CherryPy controllers and Mako templates are deprecated and fragile 

Official documentation already warns that these mechanisms: 

  • are not recommended 

  • frequently break during Python transitions 

  • have Python version compatibility problems 

  • lack automated testing coverage in EUI 

 

 


Resolution

For the 10.2  SplunkWeb is already running on Python 3.13 and that this behavior is expected and consistent with previous upgrade cycles

Splunk app developers:
Developers must ensure that the Python code that they use in Splunk Web custom REST endpoints and custom Mako templates works as expected in Python version 3.13, ideally by testing using a test Splunk Enterprise 10.2 installation. App developers can leverage AppInspect to determine if their apps are affected – any "warn" results from the following checks indicate that they must act:
Splunk Web Custom REST Endpoints: check_cherrypy_controllers
Mako Templates: check_for_existence_of_python_code_block_in_mako_template

Splunk Cloud Platform and Splunk Enterprise users:
Wherever possible, update apps from Splunkbase, including both Splunk-built and third-party apps, to versions that Splunk marks as compatible with Splunk platform 10.2, either in preparation for, or as part of, their Splunk platform upgrades.


Due to a known issue modular inputs continue to execute under Python 3.9 even when python.required = 3.13 is set


About upgrading to 10.2 READ THIS FIRST
Python 3.13 Developer Guide 

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products