Python version compatibility issues

Applicability

Description

Some apps might requiere a specific Python version.

If multiple Python versions are required in the same instance, the option force_python3 won't work as it forces all apps to use one specific version depending of the Splunk version. 

force_python3 is the default value in some Splunk versions. 

After changing the server version to python3.9 in server.conf, some apps might have compatibilities issues. 

[general]
python.version = python3.9

Investigation

If an app has compatibility issues with the  Python version, the following message will show up in splunkd.log. 

08-19-2025 01:24:39.363 +0000 ERROR PersistentScript [10964 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/TA-cisco-cloud-security-addon/bin/TA_cisco_cloud_security_addon_rh_cisco_cloud_security_addon.py persistent}: SyntaxError: invalid syntax

This message indicates that the Cisco Cloud Security Add-on is using Phython version 3.7. This app is compatible with Phython version 3.9 and not Phython version 3.7. The compatibility depends of each specific app.

The default value of Cisco Cloud Security Add-On for its scripts is python3, that indicates using Phython version 3.7.

cat /opt/splunk/etc/apps/TA-cisco-cloud-security-addon/default/inputs.conf[migration]
python.version = python3
[cisco_cloud_security_addon]
python.version = python3

Resolution

To fix the issue, create local configuration to indicate the needed python version for every script and input associated to the app:

• Check the content of the app's restmap for the scripts versions. 
  

  cat /opt/splunk/etc/apps/<app_name>/default/restmap.conf

• Create a local version of every script found in the previous step, indicating the Python version needed. 
  

  vi /opt/splunk/etc/apps/<app_name>/local/restmap.conf

  Example:
  

  [admin_external:TA_cisco_cloud_security_addon_aws_account]
  python.version = python3.9
  [admin_external:TA_cisco_cloud_security_addon_event_logs]
  python.version = python3.9
  [admin_external:TA_cisco_cloud_security_addon_settings]
  python.version = python3.9
  [script:toc_functionality_ta]
  python.version = python3.9
  [admin_external:TA_cisco_cloud_security_addon_cisco_cloud_security_addon]
  python.version = python3.9 

   

• Check the content of the app's inputs for the python version. 
  

  cat /opt/splunk/etc/apps/<app_name>/default/inputs.conf

• Create a stanza with the version needed:
  

  vi /opt/splunk/etc/apps/<app_name>/local/inputs.conf

  
  Example:
  

  [migration]
  python.version = python3.9
  [cisco_cloud_security_addon]
  python.version = python3.9

• Restart Splunk

Related Links

inputs.conf

server.conf

restmap.conf