Developing for Splunk Enterprise

Whats the difference between splunklib.* and splunk.Intersplunk

spammenot66
Contributor

I've noticed a bunch of custom search command uses splunk.Intersplunk. In the Python Splunk SDK it documents splunklib.*. Can someone provide some details on what the difference between these two libraries are? When should we use one over the other?

0 Karma
1 Solution

badarsebard
Communicator

The difference is between two versions of how to create a custom command in Splunk. The splunk.Intersplunk module is a relatively simple module baked into the Splunk Python distribution and is the version 1 style of creating custom commands that has been around since about Splunk 3.x. The splunklib package is the Splunk SDK for Python found here: http://dev.splunk.com/python. The SDK provides lots of tools for doing lots of things, including the new version 2 of how to create custom commands. There are lots of advantages to using the version 2 approach but that does come at the cost of bundling the SDK into your app. However, most agree it's worth it and it is considered best practice. There is an excellent .conf talk about the differences between the two here: https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-s....

View solution in original post

badarsebard
Communicator

The difference is between two versions of how to create a custom command in Splunk. The splunk.Intersplunk module is a relatively simple module baked into the Splunk Python distribution and is the version 1 style of creating custom commands that has been around since about Splunk 3.x. The splunklib package is the Splunk SDK for Python found here: http://dev.splunk.com/python. The SDK provides lots of tools for doing lots of things, including the new version 2 of how to create custom commands. There are lots of advantages to using the version 2 approach but that does come at the cost of bundling the SDK into your app. However, most agree it's worth it and it is considered best practice. There is an excellent .conf talk about the differences between the two here: https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-s....

View solution in original post

spammenot66
Contributor

thanks badarsebard!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.