Splunk Dev

Help with Python applications to programmatically interact with the Splunk engine

unnatiShukla
New Member

How can I write Python applications to programmatically interact with the Splunk engine. I am new to Splunk, can anyone please help me with the same. I have basic understanding with splunk queries etc. But quite new to built an apploication that interacts with Splunk engine.

Tags (2)
0 Karma

satishsdange
Builder

Splunk is a single piece of software for data collection, reporting & parsing. You can use the same binary to access core Splunk i.e. Use Search Head(s) to access Indexer(s).
Is there any specific requirement/need, you want to build a separate application using Python?

0 Karma

Damien_Dallimor
Ultra Champion

Start here with our Splunk Python SDK , there are loads of examples to get you started !

0 Karma

KenWhitesell
Path Finder

Generally speaking, programs written to access the Splunk engine are written to interact through the Splunk REST API.

There's plenty of information here regarding the API. A good place to start is
link text http://docs.splunk.com/Documentation/Splunk/6.1.3/Overview/Extending

Working directly with the REST API is possible, and sometimes the only way to accomplish certain tasks. But there are also a set of SDKs available that encapsulate a lot of the more intricate parts, making it easy to perform common functions.

Again, there's plenty of information on this site. A good place to start for the SDKs would be:
link text http://docs.splunk.com/Documentation/Splunk/6.1.3/AdvancedDev/SplunkSDKs

Finally, Splunk does offer specific SDK training. I just took the class almost a month ago and found it to be invaluable.
link text http://www.splunk.com/view/SP-CAAAHSH

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...