How to add cryptography or other python lib to Splunk python own environment for scripted input on HF?

[splunkreal]

Hello guys,

how to add cryptography or other python lib to Splunk python own environment for scripted input on HF?

Preferred solution is to put beside my app in etc/apps/myapp/bin/ folder.

Thanks for your help!

[livehybrid · Accepted solution]

Hi

Place the third-party Python library inside your app's lib directory, then add this path to sys.path at the start of your scripted input.

Example:

import sys, os
sys.path.insert(0, os.path.join(os.path.dirname(__file__), '../lib'))

import cryptography

Copy the cryptography package (and its dependencies) into $SPLUNK_HOME/etc/apps/myapp/lib/. Use pip on a compatible system:

pip install --target=$SPLUNK_HOME/etc/apps/myapp/lib/cryptography

Ensure the Python version used to build the packages matches Splunk's embedded Python (e.g., Python 3.7 or 3.9) on your HF.

You can use the bin directory instead of lib if you prefer, but I've always been advised to use the lib directory. It shouldnt make much difference though.

Check out this page for more info too: https://docs.splunk.com/Documentation/Splunk/9.4.1/Python3Migration/PythonDevelopment

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[thellmann]

Two small points: 

1. I would avoid the usage of the /lib directory in app code. It was intended to work around an issue that no longer exists (outside of persistent custom REST endpoints) and causes additional issues for extension points that distribute resources to search peers (i.e. certain types of custom search commands and external lookups) - you will need to update .conf files to make sure that the /lib directory is distributed correctly. There are no advantages to using /lib over /bin and /bin is automatically distributed to search peers as required. 

2. Similarly, the guidance to do import manipulation using sys.path.insert is also outdated, as it does not prevent import collisions within the context of persistent custom REST endpoints). 

e: In the context of a scripted input it shouldn't matter either way. I just want to make sure it's understood where the /lib guidance came from and why it is out of date today. 

I'm working to get the old guidance removed from dev.splunk.com and examples on github - appreciate your patience in the meantime. 

[richgalloway]

Don't add to or touch the Python libraries that ship with Splunk as they will be replaced with each upgrade.  Put the required libraries (that Splunk doesn't provide) in your app.  This is the way.

[splunkreal]

Hi @richgalloway thanks, how do you add library to custom app? In bin folder with .py file?