topic Re: Splunk search head's python library Vs Python 3.8 in Splunk Dev

Splunk search head's python library Vs Python 3.8

vamsigurram — Mon, 23 Nov 2020 01:56:31 GMT

Hi,

From the below github link, I see this python code, which works on the search head(linux), when I use this command.

/opt/splunk/bin/splunk cmd python ko_change.py

https://github.com/harsmarvania57/splunk-ko-change/blob/master/ko_change.py

I see below import statements.

import splunk.rest as rest
import splunk.auth as auth

When I use these, import statements, in my laptop, vscode, it get below error.

"ModuleNotFoundError: No Module named "splunk.auth"; 'splunk' is not a package"

"ModuleNotFoundError: No Module named "splunk.rest"; 'splunk' is not a package"

I have splunk-sdk installed in my vscode. splunklib is working.

So the question here is, how come the above import statements work on splunk search head(Linux) , but not in vscode (in my laptop), even when I have splunk-sdk installed?

What library, do I need to install, to make splunk.auth and splunk.rest work in vscode (on my windows laptop)

Re: Splunk search head's python library Vs Python 3.8

thambisetty — Mon, 23 Nov 2020 07:40:20 GMT

@harsmarvania57

Re: Splunk search head's python library Vs Python 3.8

inventsekar — Mon, 23 Nov 2020 09:02:18 GMT

Hi @vamsigurram .. got a curious question.. when this works on Search Head, why you want to run this on laptop?!

just for learning!

Re: Splunk search head's python library Vs Python 3.8

harsmarvania57 — Mon, 23 Nov 2020 10:44:52 GMT

Hi,

I am developer/owner of that script and that script only works with Splunk Enterprise, you can't use that script with Splunk Python SDK.

Thanks,

Harshil

Re: Splunk search head's python library Vs Python 3.8

vamsigurram — Mon, 23 Nov 2020 13:40:48 GMT

@inventsekar Yes, its for learning more on splunk.rest.

But as @harsmarvania57 mentioned, its a bummer why splunk-sdk does not have those libraries.

Now I have to code directly in linux (without vscode)

Re: Splunk search head's python library Vs Python 3.8

harsmarvania57 — Mon, 23 Nov 2020 13:49:26 GMT

You can use vscode but you need to install Splunk Enterprise on your desktop.

Re: Splunk search head's python library Vs Python 3.8

vamsigurram — Mon, 23 Nov 2020 13:51:48 GMT

Good idea.

I will try that. Thanks again for your help.

Re: Splunk search head's python library Vs Python 3.8

inventsekar — Mon, 23 Nov 2020 23:12:59 GMT

(oops, i had assumed that you have installed splunk on your laptop, my bad!)

... soo, on your laptop, you installed only the "splunk-sdk" and tried to run that github file!!!

"the splunk-sdk always needs the Splunk, at its base"(as per my understanding).

Re: Splunk search head's python library Vs Python 3.8

thambisetty — Tue, 24 Nov 2020 05:46:51 GMT

@vamsigurram

Below is the location where you will find splunk python modules.

$SPLUNK_HOME/lib/python2.7/site-packages/splunk

$SPLUNK_HOME/lib/python3.7/site-packages/splunk