The Splunk Enterprise Software Development Kit (SDK) for Python is intended to be the primary way for developers to communicate with the Splunk platform's REST API.

You may be asking:

• What are Splunk Apps?
• What can Splunk Apps do?
• How do I write Splunk Apps?
• Where does the SDK fit in all this?
• What's the difference between import splunklib and import splunk?
  • This repo contains splunklib, whereas splunk is an internal library bundled with the Splunk platform.
• How do I use AI in Splunk Apps?

• Python 3.13 or newer
• Splunk Enterprise/Cloud

Using uv:

If you prefer not using uv, using pip should work as expected:

Because of the way Splunk Apps are built, you need to install your external dependencies to bin/lib/ for the App to work. Then in your App script files:

An example workflow to package your App for uploading to Splunk (expect to modify it heavily):

See docs for more details.

The easiest and most effective way of learning how to use this library should be reading through the apps in our test suite, as well as the splunk-app-examples repository. They show how to programmatically interact with the Splunk platform in a variety of scenarios - from basic metadata retrieval, one-shot searching and managing saved searches to building complete applications with modular inputs and custom search commands.

For details, see the examples using the Splunk Enterprise SDK for Python on the Splunk Developer Portal, as well as the Splunk Enterprise SDK for Python Reference

You can now leverage AI capabilities within your Splunk Apps using the splunklib.ai package. Take a look at its README to find out how to enhance your Apps agentic behaviour, custom tools and more.

TODO: Link docs about this

• The service metadata object is created from the splunkd URI and session key passed to the command invocation the search results info file and is available in MyCommand.generate/transform/stream/reduce methods depending on the Custom Search Command.

When working with custom search commands such as Custom Streaming Commands or Custom Generating Commands, we may need to add new fields to the records based on certain conditions. Structural changes like this may not be preserved. If you're having issues with field retention, make sure to use add_field(record, fieldname, value) method from SearchCommand to add a new field and value to the record.

• Generating Custom Search Command is used to generate events using SDK code.
• Make sure to use gen_record() method from SearchCommand to add a new record and pass event data as comma-separated key=value pairs (mentioned in below example).

Go here to find out more about setting up a Modular Input.

• The service metadata object is created from the splunkd URI and session key passed to the command invocation on the modular input stream respectively, and is available as soon as the <script_name>.stream_events() or <script_name>.validate_input() method is called.

• In stream_events() you can access Modular Input app metadata from InputDefinition object

• See the Modular Input App example for reference.

  def stream_events(self, inputs, ew): # [...] # Access the modular input app's metadata (like server_host, server_uri, etc) from `InputDefinition` object server_host = inputs.metadata["server_host"] server_uri = inputs.metadata["server_uri"] checkpoint_dir = inputs.metadata["checkpoint_dir"]

We welcome all contributions! If you would like to contribute to the SDK, see Contributing to Splunk. For additional guidelines, see CONTRIBUTING.

Make sure you have uv and docker/podman installed and available in your $PATH. Run make uv-sync to get a virtualenv set up or updated. After activating it with source .venv/bin/activate you should be ready to go!

To connect to Splunk Enterprise, many of the SDK examples and unit tests take command-line arguments that specify values for the host, port, and authentication. For convenience during development, you can store these arguments as key-value pairs in an .env file.

A file called .env.template exists in the root of this repository. Duplicate it as .env, then adjust it to your match your environment.

WARNING: The .env file isn't part of the Splunk platform. This is not the place for production credentials!

This repository contains a suite of unit and integration tests.

The integration suite requires docker/podman to work.

NOTE: Before running the integration tests, make sure the instance of Splunk you are testing against doesn't have new events being dumped continuously into it. Several of the tests rely on a stable event count. It's best to test against a clean install of Splunk but if you can't, you should at least disable the *NIX and Windows apps.

Do not run the test suite against a production instance of Splunk! It will run just fine with the free Splunk license.

The default level is WARNING, which means that only events of this level and above will be visible To change a logging level we can call setup_logging() method and pass the logging level as an argument.

Optionally, you can also provide a custom log and date format string. When in doubt, always refer to the source code.

Stay connected with other developers building on the Splunk platform.

• Splunk Answers
• Issues and pull requests
• Send an e-mail to Splunk Dev Platform

• You will be granted support if you or your company are already covered under an existing maintenance/support agreement. Submit a new case in the Support Portal and include at least Splunk Enterprise SDK for Python in the subject line.

  If you are not covered under an existing maintenance/support agreement, you can find help through the broader community at Splunk Answers.

• Splunk will NOT provide support for SDKs if the core library (code in the /splunklib directory) has been modified. If you modify the SDK and want support, try finding it with the broader community, e.g. Splunk Answers.

  That said, we'd also like to know why you felt the need to modify the core library, so please send feedback and file any issues in our GitHub Issues.