topic Re: How can move the knowledge object in Splunk by using Splunk SDK (Python) in Splunk Dev

How can move the knowledge object in Splunk by using Splunk SDK (Python)

tatdat171 — Tue, 18 Jun 2024 05:52:55 GMT

Hi everyone, I am writing the Python script to move the knowledge object to another app.

For example, with the Lookup file:
I can do it with the REST API endpoint

servicesNS/<user>/<app_name>/data/lookup-table-files/<lookup_file_name/move

But I can't find the function to do that with the Splunk Python SDK.

https://docs.splunk.com/DocumentationStatic/PythonSDK/1.7.4/client.html#splunklib.client.Configurations
If you have experience with Splunk SDK, please share it with me. Thank!

Re: How can move the knowledge object in Splunk by using Splunk SDK (Python)

KendallW — Tue, 18 Jun 2024 06:05:36 GMT

Hi @tatdat171 Check out this script by @harsmarvania57

https://github.com/harsmarvania57/splunk-ko-change

Re: How can move the knowledge object in Splunk by using Splunk SDK (Python)

tatdat171 — Tue, 18 Jun 2024 06:08:25 GMT

Thank @KendallW , that is good reference to CRUD with KOs in the Splunk but the script is out of date, some function did not work anymore. And he used REST API instead of SDK.
I am asking about the Splunk SDK.

Re: How can move the knowledge object in Splunk by using Splunk SDK (Python)

harsmarvania57 — Tue, 18 Jun 2024 08:02:49 GMT

Hi @tatdat171 Script which I have created is not out of date. It still works for On-prem and SplunkCloud. I would like to know which functions didn't work for you. Thanks, Harshil

Re: How can move the knowledge object in Splunk by using Splunk SDK (Python)

tatdat171 — Tue, 18 Jun 2024 08:11:06 GMT

Hi @harsmarvania57 ,
I am very appreciate what you did with the script!
In your script, you are using the python package "splunk"

from splunk import mergeHostPath
import splunk.rest as rest
import splunk.auth as auth
import splunk.entity as entity

But I can't find the package with pip install. could you give the correct name of package?

Re: How can move the knowledge object in Splunk by using Splunk SDK (Python)

harsmarvania57 — Tue, 18 Jun 2024 09:32:17 GMT

Hi @tatdat171 ,

I am using python modules which are shipped with Splunk Enterprise so to use my script you need Splunk Enterprise as well (you don't need to start/run Splunk Enterprise locally).

Re: How can move the knowledge object in Splunk by using Splunk SDK (Python)

tatdat171 — Wed, 19 Jun 2024 15:47:33 GMT

Thank @harsmarvania57, my bad. It worked as well.

I want to write another script that used Splunk SDK, which does not depend on Splunk lib, or must run the script in Splunk server.
Any way, I nearly finished with my the script by using SDK.
Thank for your help and your script helped me a lot!