https://community.splunk.com/t5/Splunk-Dev/Whats-the-difference-between-splunklib-and-splunk-Intersplunk/m-p/418483#M7308 <P>The difference is between two versions of how to create a custom command in Splunk. The <CODE>splunk.Intersplunk</CODE> module is a relatively simple module baked into the Splunk Python distribution and is the version 1 style of creating custom commands that has been around since about Splunk 3.x. The <CODE>splunklib</CODE> package is the Splunk SDK for Python found here: <A href="http://dev.splunk.com/python">http://dev.splunk.com/python</A>. The SDK provides lots of tools for doing lots of things, including the new version 2 of how to create custom commands. There are lots of advantages to using the version 2 approach but that does come at the cost of bundling the SDK into your app. However, most agree it's worth it and it is considered best practice. There is an excellent .conf talk about the differences between the two here: <A href="https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-sdk-for-python.pdf">https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-sdk-for-python.pdf</A>.</P> Thu, 18 Apr 2019 12:32:09 GMT badarsebard 2019-04-18T12:32:09Z https://community.splunk.com/t5/Splunk-Dev/Whats-the-difference-between-splunklib-and-splunk-Intersplunk/m-p/418482#M7307 <P>I've noticed a bunch of custom search command uses splunk.Intersplunk. In the Python Splunk SDK it documents splunklib.*. Can someone provide some details on what the difference between these two libraries are? When should we use one over the other? </P> Wed, 17 Apr 2019 13:32:05 GMT https://community.splunk.com/t5/Splunk-Dev/Whats-the-difference-between-splunklib-and-splunk-Intersplunk/m-p/418482#M7307 spammenot66 2019-04-17T13:32:05Z https://community.splunk.com/t5/Splunk-Dev/Whats-the-difference-between-splunklib-and-splunk-Intersplunk/m-p/418483#M7308 <P>The difference is between two versions of how to create a custom command in Splunk. The <CODE>splunk.Intersplunk</CODE> module is a relatively simple module baked into the Splunk Python distribution and is the version 1 style of creating custom commands that has been around since about Splunk 3.x. The <CODE>splunklib</CODE> package is the Splunk SDK for Python found here: <A href="http://dev.splunk.com/python">http://dev.splunk.com/python</A>. The SDK provides lots of tools for doing lots of things, including the new version 2 of how to create custom commands. There are lots of advantages to using the version 2 approach but that does come at the cost of bundling the SDK into your app. However, most agree it's worth it and it is considered best practice. There is an excellent .conf talk about the differences between the two here: <A href="https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-sdk-for-python.pdf">https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-sdk-for-python.pdf</A>.</P> Thu, 18 Apr 2019 12:32:09 GMT https://community.splunk.com/t5/Splunk-Dev/Whats-the-difference-between-splunklib-and-splunk-Intersplunk/m-p/418483#M7308 badarsebard 2019-04-18T12:32:09Z https://community.splunk.com/t5/Splunk-Dev/Whats-the-difference-between-splunklib-and-splunk-Intersplunk/m-p/418484#M7309 <P>thanks badarsebard!</P> Thu, 25 Apr 2019 11:44:33 GMT https://community.splunk.com/t5/Splunk-Dev/Whats-the-difference-between-splunklib-and-splunk-Intersplunk/m-p/418484#M7309 spammenot66 2019-04-25T11:44:33Z