Splunk Enterprise Security upgrade fails due to installation error of Scientific Python App

Available Languages

Updated:October 1, 2026
Document ID:SPLK051524

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Security 7.3.x and ES 8.0.x

Description

During the upgrade process to ES 8.0.4 or ES 7.3.3, the process may fail with an error similar to:

ES 7.3 ==> Upgrade failed: filename="/.../Splunk_SA_Scientific_Python_linux_x86_64-3.2.1-0.tgz" status="500"
ES 8.0 ==> Upgrade failed: filename="/.../Splunk_SA_Scientific_Python_linux_x86_64-3.1.0-0.tgz" status="500"

This occurs because the installer attempts to upgrade the Scientific Python package, which is not necessary and can safely be skipped.


Investigation

  1. Attempted to upgrade from ES 7.2 to 7.3 or ES 7.3 to 8.0.4. The upgrade process timed out during the Post-Install Configuration phase and exited unexpectedly.

  2. Observed the following error in essinstaller2.log:

    2025-04-25 23:32:01,744+0000 ERROR pid=721027 tid=MainThread file=essinstall.py:die:309 | (InstallException) "install_apps" stage failed - Splunkd daemon is not responding: ('Error connecting to /services/admin/localapps: The read operation timed out',)
     

  3. Increased the splunkdConnectionTimeout value from the default 60 to 300 in $SPLUNK_HOME/etc/system/local/web.conf.

    Then re-ran the upgrade, but the timeout issue persisted.

  4. Further review of essinstaller2.log revealed a failure when processing the Scientific Python app:

    2025-05-08 19:39:36,530+0000 ERROR pid=3540677 tid=MainThread file=essinstall.py:die:309 | (InstallException) "install_apps" stage failed - Upgrade failed: filename="/splunk/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install/Splunk_SA_Scientific_Python_linux_x86_64-3.2.1-0.tgz" status="500"

This confirmed the upgrade was being blocked by issues related to installing Splunk_SA_Scientific_Python.


Resolution

  1. SSH into the ES search head as the splunk user.

  2. Edit the file:

    vi $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/install/installable_apps.txt

  3. Remove the following lines (for ES 8.0 upgrade as example here):

    Splunk_SA_Scientific_Python_linux_x86_64-3.2.1-0.tgz
Splunk_SA_Scientific_Python_windows_x86_64-3.2.1-0.tgz

  4. Save the file and re-run the ES upgrade.

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco