ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

WSS-Splunk plugin displays message that "app is not compatible with Python 3"

book

Article ID: 227387

calendar_today

Updated On:

Products

Web Security Service - WSS

Issue/Introduction

WSS HTTP logs pulled into Splunk using SyncAPI endpoints

Splunk Server running 8.2 code

WSS Splunk TA plugin installed and on latest 2.0.0 version

WSS Splunk pluging appears to be using Python version 2, which will no longer be available at end of October 

Splunk WSS TA reporting "This app is not compatibl with Python 3"

 

 

 

Cause

Although the WSS TA plugins support both Python 2 and Python 3 libraries, Splunk needs to define which library set to use.

In the above case, Splunk was configured to use the Python 2 libraries that were being obsoleted. 

Environment

Splunk 8.2

WSS Splunk TA plugin v2.0.0

WSS SyncAPI endpoint

Resolution

Switch Splunk setup from using the default Python 2 library set to Python 3 following instructions defined at https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/Python3LowEffort

  1. Once you're satisfied that all your scripts are working as expected, specify the global Python 3 runtime in your test environment.
    1. Go to $SPLUNK_HOME/etc/system/local/server.conf and set python.version=python3.
    2. Restart Splunk Enterprise.
    3. Test any Python scripts that are on a critical path, such as scripted authentication, to ensure they continue to work.