WSS-Splunk plugin displays message that "app is not compatible with Python 3"

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

WSS HTTP logs pulled into Splunk using SyncAPI endpoints

Splunk Server running 8.2 code

WSS Splunk TA plugin installed and on latest 2.0.0 version

WSS Splunk pluging appears to be using Python version 2, which will no longer be available at end of October 

Splunk WSS TA reporting "This app is not compatibl with Python 3"

 

 

 

Environment

Splunk 8.2

WSS Splunk TA plugin v2.0.0

WSS SyncAPI endpoint

Cause

Although the WSS TA plugins support both Python 2 and Python 3 libraries, Splunk needs to define which library set to use.

In the above case, Splunk was configured to use the Python 2 libraries that were being obsoleted. 

Resolution

Switch Splunk setup from using the default Python 2 library set to Python 3 following instructions defined at https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/Python3LowEffort

1. Once you're satisfied that all your scripts are working as expected, specify the global Python 3 runtime in your test environment.

   1. Go to $SPLUNK_HOME/etc/system/local/server.conf and set python.version=python3.
   2. Restart Splunk Enterprise.
   3. Test any Python scripts that are on a critical path, such as scripted authentication, to ensure they continue to work.