You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Splunk Enterprise Software Development Kit (SDK) for Python contains library code designed to enable developers to build applications using the Splunk platform.
6
7
7
-
The Splunk platform is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search, and process large time-varying data sets.
8
-
9
-
The Splunk platform is popular with system administrators for aggregation and monitoring of IT machine data, security, compliance, and a wide variety of other scenarios that share a requirement to efficiently index, search, analyze, and generate real-time notifications from large volumes of time-series data.
10
-
11
-
The Splunk developer platform enables developers to take advantage of the same technology used by the Splunk platform to build exciting new applications.
8
+
Splunk is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search, and process large time-varying data sets.
12
9
13
10
## Getting started
14
11
15
-
The Splunk Enterprise SDK for Python contains library code, and its examples are located in the [splunk-app-examples](https://github.com/splunk/splunk-app-examples) repository. They show how to programmatically interact with the Splunk platform for a variety of scenarios including searching, saved searches, data inputs, and many more, along with building complete applications.
16
-
17
12
### Requirements
18
13
19
-
#### Python
14
+
#### Python compatibility
20
15
21
-
The Splunk Enterprise SDK for Python has been tested only with Python 3.7, 3.9 and 3.13.
16
+
Splunk Enterprise SDK for Python is tested only with Python 3.7, 3.9 and 3.13. Latest version is always recommended.
22
17
23
18
#### Splunk Enterprise
24
19
25
-
The Splunk Enterprise SDK for Python has been tested with Splunk versions supported in the [Splunk Software Support Policy](https://www.splunk.com/en_us/legal/splunk-software-support-policy.html)
20
+
This SDK is only tested with Splunk versions supported in the [Splunk Software Support Policy](https://www.splunk.com/en_us/legal/splunk-software-support-policy.html)
21
+
22
+
[Go here](http://www.splunk.com/download) to get Splunk Enterprise.
26
23
27
-
If you haven't already installed Splunk Enterprise, [get it here](http://www.splunk.com/download).
28
-
For more information, see the Splunk Enterprise [_Installation Manual_](https://docs.splunk.com/Documentation/Splunk/latest/Installation).
24
+
For more information, see the Splunk Enterprise [Installation Manual](https://docs.splunk.com/Documentation/Splunk/latest/Installation).
29
25
30
-
### Install the SDK
26
+
### Installing the SDK
31
27
32
-
<!-- TODO: Remake this -->
28
+
[uv](https://docs.astral.sh/uv/) is our tool of choice for development. Usually that means creating a project with `uv init` and installing the SDK with `uv add splunk-sdk`. When in doubt, consult `uv` docs.
33
29
34
-
Refer to standard Python package installation methods. Most of the time, a local `virtualenv` is preferred over a system-wide installation.
30
+
If you prefer not using `uv`, the standard Python package installation method still works:
35
31
36
32
```sh
33
+
python -m venv .venv
34
+
source .venv/bin/activate
37
35
python -m pip install splunk-sdk
38
36
```
39
37
40
-
### How to connect to a Splunk Enterprise instance
38
+
#### Create an .env file (optional)
39
+
40
+
To connect to Splunk Enterprise, many of the SDK examples and unit tests take command-line arguments that specify values for the host, port, and authentication. For convenience during development, you can store these arguments as key-value pairs in a `.env` file.
41
+
42
+
A file called `.env.template` exists in the root of this repository. Duplicate it as `.env`, then adjust it to your match your environment.
43
+
44
+
> **WARNING:** The `.env` file isn't part of the Splunk platform. This is **not** the place for production credentials!
41
45
42
-
#### Create an .env file
46
+
###SDK usage examples
43
47
44
-
To connect to Splunk Enterprise, many of the SDK examples and unit tests take command-line arguments that specify values for the host, port, and authentication. For convenience during development, you can store these arguments as key-value pairs in a `.env` file. SDK examples and unit tests use the values from the `.env` file if they're not specified manually.
48
+
The easiest and most effective way of learning how to use this library should be reading through the apps in our test suite, as well as the [splunk-app-examples](https://github.com/splunk/splunk-app-examples) repository. They show how to programmatically interact with the Splunk platform in a variety of scenarios - from basic metadata retrieval, one-shot searching and managing saved searches to building complete applications with modular inputs and custom search commands.
45
49
46
-
> **NOTE:** This file isn't part of the Splunk platform. Therefore it shouldn't be used for storing production credentials. Do not use it if security is a concern - provide them in the command line instead.
50
+
For details, see the [examples using the Splunk Enterprise SDK for Python](https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/examplespython) on the Splunk Developer Portal, as well as the [Splunk Enterprise SDK for Python Reference](http://docs.splunk.com/Documentation/PythonSDK)
47
51
48
-
A `.env.template` exists in the root of this repository. Just duplicate it, remove `.template` from the name and adjust it to your match your environment
52
+
#### Connecting to a Splunk Enterprise instance
49
53
50
-
#### Using username/password
54
+
#####Using a username/password combo
51
55
52
56
```python
53
57
import splunklib.client as client
54
58
55
59
service = client.connect(host=<HOST_URL>, username=<USERNAME>, password=<PASSWORD>, autologin=True)
56
60
```
57
61
58
-
#### Using bearer token
62
+
#####Using a bearer token
59
63
60
64
```python
61
65
import splunklib.client as client
62
66
63
67
service = client.connect(host=<HOST_URL>, splunkToken=<BEARER_TOKEN>, autologin=True)
64
68
```
65
69
66
-
#### Using session key
70
+
#####Using a session key
67
71
68
72
```python
69
73
import splunklib.client as client
70
74
71
75
service = client.connect(host=<HOST_URL>, token=<SESSION_KEY>, autologin=True)
72
76
```
73
77
74
-
#### SDK examples
75
-
76
-
Examples for the Splunk Enterprise SDK for Python are located in the [splunk-app-examples](https://github.com/splunk/splunk-app-examples) repository. For details, see the [Examples using the Splunk Enterprise SDK for Python](https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/examplespython) on the Splunk Developer Portal.
77
-
78
-
#### Run test suite
79
-
80
-
This repo contains a collection of unit and integration tests.
81
-
82
-
##### Unit tests
83
-
84
-
To run all the tests (unit and integration):
85
-
86
-
```sh
87
-
make test
88
-
```
89
-
90
-
##### Integration tests
91
-
92
-
###### Prerequisites
93
-
94
-
-`docker`/`podman`
95
-
-`tox`
96
-
97
-
```sh
98
-
SPLUNK_VERSION=latest && make start
99
-
```
100
-
101
78
### Customization
102
79
103
80
When working with custom search commands such as Custom Streaming Commands or Custom Generating Commands, we may need to add new fields to the records based on certain conditions. Structural changes like this may not be preserved.
@@ -174,13 +151,13 @@ class GeneratorTest(GeneratingCommand):
174
151
175
152
#### Custom Search Commands
176
153
177
-
- The service object is created from the Splunkd URI and session key passed to the command invocation the search results info file.
154
+
- The service object is created from the `splunkd` URI and session key passed to the command invocation the search results info file.
178
155
- Service object can be accessed using `self.service` in `generate`/`transform`/`stream`/`reduce` methods depending on the Custom Search Command.
179
156
180
-
##### Generating a Custom Search Command
157
+
##### Getting Splunk instance metadata
181
158
182
159
```python
183
-
defgenerate(self):
160
+
defget_metadata(self):
184
161
# [...] other code
185
162
186
163
# Access service object that can be used to connect Splunk Service
@@ -191,7 +168,7 @@ def generate(self):
191
168
192
169
#### Modular Inputs app
193
170
194
-
- The service object is created from the Splunkd URI and session key passed to the command invocation on the modular input stream respectively.
171
+
- The service object is created from the `splunkd` URI and session key passed to the command invocation on the modular input stream respectively.
195
172
- It is available as soon as the `Script.stream_events` method is called.
196
173
197
174
```python
@@ -204,27 +181,55 @@ def generate(self):
204
181
info = service.info
205
182
```
206
183
184
+
### Running the test suite
185
+
186
+
This repo contains a collection of unit and integration tests.
187
+
188
+
#### Unit tests
189
+
190
+
To run both unit and integration tests:
191
+
192
+
```sh
193
+
make test
194
+
```
195
+
196
+
#### Integration tests
197
+
198
+
> NOTE: Before running the integration tests, make sure the instance of Splunk you are testing against doesn't have new events being dumped continuously into it. Several of the tests rely on a stable event count. It's best to test against a clean install of Splunk but if you can't, you should at least disable the \*NIX and Windows apps.
199
+
200
+
Do not run the test suite against a production instance of Splunk! It will run just fine with the free Splunk license.
201
+
202
+
##### Prerequisites
203
+
204
+
-`docker`/`podman`
205
+
-`tox`
206
+
207
+
```sh
208
+
SPLUNK_VERSION=latest && make start
209
+
```
210
+
207
211
### Optional: Set up logging for splunklib
208
212
209
-
- The default level is WARNING, which means that only events of this level and above will be visible
210
-
- To change a logging level we can call setup_logging() method and pass the logging level as an argument.
211
-
- Optional: we can also pass log format and date format string as a method argument to modify default format
213
+
The default level is WARNING, which means that only events of this level and above will be visible
214
+
To change a logging level we can call setup_logging() method and pass the logging level as an argument.
212
215
213
-
```python
214
-
import logging
215
-
from splunklib import setup_logging
216
+
> Optionally, you can also provide a custom log and date format string. When in doubt, always refer to the source code.
216
217
217
-
# To see debug and above level logs
218
-
setup_logging(logging.DEBUG)
219
-
```
218
+
```python
219
+
import logging
220
+
from splunklib import setup_logging
221
+
222
+
# To see debug and above level logs
223
+
setup_logging(logging.DEBUG)
224
+
```
220
225
221
226
### Changelog
222
227
223
228
The [CHANGELOG](CHANGELOG.md) contains a description of changes for each version of the SDK. For the latest version, see the [CHANGELOG.md](https://github.com/splunk/splunk-sdk-python/blob/master/CHANGELOG.md) on GitHub.
224
229
225
230
### Branches
226
231
227
-
Right now, the`master` branch represents a stable and released version of the SDK.
232
+
The`master` branch represents a stable and released version of the SDK.
228
233
`develop` is where development between releases is happening.
229
234
230
235
To learn more about our branching model, see [Branching Model](https://github.com/splunk/splunk-sdk-python/wiki/Branching-Model) on GitHub.
@@ -270,7 +275,3 @@ If you are not covered under an existing maintenance/support agreement, you can
270
275
### Contact us
271
276
272
277
You can reach the Splunk Developer Platform team at <mailto:[email protected]>.
273
-
274
-
## License
275
-
276
-
The Splunk Enterprise Software Development Kit for Python is licensed under the Apache License 2.0. See [LICENSE](LICENSE) for details.
0 commit comments