Managing Python 3.7 and Python 3.9 in Splunk After Upgrading to Version 9.3

Applicability

Description

Upon upgrading to Splunk version 9.3, Python 3.9 becomes the default version for the environment. However, the older Python 3.7 executable may still exist. The question arises whether to remove Python 3.7 or keep it for backward compatibility.

How to Identify It:

• Splunk has been successfully upgraded to Splunk version 9.3, and Python 3.9 is now the default version.
• You notice that python3.7.exe still exists within the Splunk installation directory.
• There may be custom scripts or third-party apps in your environment that were designed for Python 3.7, raising concerns about compatibility with Python 3.9.

Investigation

To assess the need for Python 3.7, the following investigation steps were performed:

1. Compatibility Check:

   • Verified all custom scripts and third-party Splunk apps for Python version compatibility.
   • Referenced Splunkbase documentation for each app to ensure they are compatible with Python 3.9.

2. Testing in a Staging Environment:

   • Tested the upgraded Splunk instance in a non-production environment, ensuring core functionalities, searches, and dashboards run smoothly with Python 3.9.
   • Ran any Python-based scripts or integrations that might still reference Python 3.7 to verify compatibility with Python 3.9.
   • Ensured critical jobs and processes dependent on Python (e.g., scripted inputs, custom commands) continued to function properly with Python 3.9.

3. Dependency Review:

   • Identified whether any external dependencies or integrations still required Python 3.7 for proper execution.
   • Checked Splunk log files for any warnings or errors that could indicate compatibility issues.

Resolution

Short-Term Resolution: Keep Python 3.7 alongside Python 3.9 for the following reasons:

• Custom scripts, apps, or add-ons might still require Python 3.7.
• If compatibility testing is ongoing, retaining Python 3.7 provides a fallback option.

Long-Term Resolution: Once compatibility testing is complete and everything works with Python 3.9, proceed to remove Python 3.7 by following these steps:

1. Backup:

   • Backup all necessary configurations, scripts, and data before removing Python 3.7.

2. Check Dependencies:

   • Review all apps, scripts, and configurations one final time to confirm they no longer require Python 3.7.

3. Uninstall Python 3.7:

   • Navigate to the Splunk installation directory (e.g., /opt/splunk for Linux or C:\Program Files\Splunk for Windows).
   • Safely remove the python3.7.exe binary, and any associated libraries or dependencies.

4. Monitor Post-Removal:

   • Restart the Splunk instance.
   • Monitor Splunk for any errors, especially regarding Python-based scripts or apps, to ensure nothing is broken.

Related Links

Python 3 migration with the Splunk platform
Changes to Splunk Enterprise with Python 3
Upgrade using the Python 3 runtime and dual-compatible Python syntax in custom scripts