Splunk Dev

Python SDK Requirements: Why is my script failing when attempting to access Splunk server from another VM?

mhassan24
Explorer

Scenario: Accessing remote Splunk Enterprise server from another VM using Python SDK that does not have Splunk Enterprise installed.
Issue: Added a scripts in directory /splunk-sdk-python-1.6.2/examples but it is failing.

  • For instance: [root@VMW-ELK-TEST-01 examples]# python runsearch.py Traceback (most recent call last): File "runsearch.py", line 3, in import splunklib.results as results ImportError: No module named splunklib.results

Questions:

  1. Is this happening because the VM wherein I am running this script does not have Splunk Enterprise installed?
  2. If so, what are the alternatives to interacting with the Splunk Enterprise cluster from a "Scripts" VM wherein we do not want to pay for licensing and just use the SDK API wrapper to interact.

P.S.
I was able to get one of the sample scripts in the examples directory to work accordingly:

python search.py "search index=pci_jbx_index * | head 10" --host=a.b.c.d --username="abc" --password="def" --output_mode=csv --verbose=verbose

Thanks everyone in advance,
-Mohammad

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, the runsearch.py script is failing because Splunk is not installed on the local system. Splunk-provided python includes modules specific to Splunk. You have a couple of options:

1) Install Splunk on the scripts VM. There is no cost to install the software. If you never run it there will be no licensing costs, either.
2) Copy the splunklib.py module from your Splunk system to the scripts VM. There may be other modules to copy as well, which you'll discover through trial-and-error.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, the runsearch.py script is failing because Splunk is not installed on the local system. Splunk-provided python includes modules specific to Splunk. You have a couple of options:

1) Install Splunk on the scripts VM. There is no cost to install the software. If you never run it there will be no licensing costs, either.
2) Copy the splunklib.py module from your Splunk system to the scripts VM. There may be other modules to copy as well, which you'll discover through trial-and-error.

---
If this reply helps you, Karma would be appreciated.

mhassan24
Explorer

Thanks Rich. That makes sense. I'll install it and let it automatically become the free edition after the trial expires

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...