Splunk Dev

coldToFrozenScript - with python 3.6 - Problems

hiph151
Explorer

Hi there,

i expand the coldToFrozenScript.py to a compressing & encryption function (tar and python gpg) .
It runs well when i start this manualy with python3 . I cant run this in python 2.7 because i got several errors.

So when spunk starts the script, i got errors.. Have you any idea which i can solve this issue? I know, splunk use python 2.7 but iḿ not python experienced very well.

Thx !

BucketMover - coldToFrozenScript cmd='"/usr/bin/python3.6" "/home/phil/Nextcloud/Work/coldToFrozen_testing_python3_manual.py" /opt/splunk/var/lib/splunk/test/colddb/db_1552398887_1552398884_47' exited with non-zero status='exited with code 1'
03-12-2019 15:40:37.126 +0100 ERROR BucketMover - coldToFrozenScript cmd='"/usr/bin/python3.6" "/home/phil/Nextcloud/Work/coldToFrozen_testing_python3_manual.py" /opt/splunk/var/lib/splunk/test/colddb/db_1552398895_1552398893_48' exited with non-zero status='exited with code 1'
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript Error in sitecustomize; set PYTHONVERBOSE for traceback:
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript AttributeError: module 'sys' has no attribute 'setdefaultencoding'
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript Traceback (most recent call last):
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript File "/home/phil/Nextcloud/Work/coldToFrozen_testing_python3_manual.py", line 5, in
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript import fs
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript File "/usr/local/lib/python3.6/dist-packages/fs/init.py", line 4, in
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript import("pkg_resources").declare_namespace(name)
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript File "/opt/splunk/lib/python2.7/site-packages/pkg_resources.py", line 33
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript def _bypass_ensure_directory(name, mode=0777):
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript ^
03-12-2019 15:40:37.170 +0100 ERROR BucketMover - coldToFrozenScript SyntaxError: invalid token
03-12-2019 15:40:37.175 +0100 ERROR BucketMover - coldToFrozenScript Error in sitecustomize; set PYTHONVERBOSE for traceback:

0 Karma

yannK
Splunk Employee
Splunk Employee

just my 2 cents.
If you have python 3.6 installed on the same instance than splunk, could you reconfigure your splunk python 2.7 coldToFrozenScript script as a wrapper to pass the argument to a different script that will execute on the 3.6 version, then return the results.

Long term, it seems that the python 2.7 will be deprecated, so maybe a new version will be shipped with splunk in the future.
see this official response: https://www.splunk.com/blog/2018/10/26/splunk-and-python-2-7-eol.html

0 Karma

hiph151
Explorer

Thx for your answer. I could solv this problem, i got the script to run with my extension under python 2.7.
But next year Python 2.7 will be deprecated so than also Splunk have to move.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...