Python SDK Requirements: Why is my script failing when attempting to access Splunk server from another VM?

[mhassan24]

Scenario: Accessing remote Splunk Enterprise server from another VM using Python SDK that does not have Splunk Enterprise installed.
Issue: Added a scripts in directory /splunk-sdk-python-1.6.2/examples but it is failing.

• For instance: [root@VMW-ELK-TEST-01 examples]# python runsearch.py Traceback (most recent call last): File "runsearch.py", line 3, in import splunklib.results as results ImportError: No module named splunklib.results

Questions:

1. Is this happening because the VM wherein I am running this script does not have Splunk Enterprise installed?
2. If so, what are the alternatives to interacting with the Splunk Enterprise cluster from a "Scripts" VM wherein we do not want to pay for licensing and just use the SDK API wrapper to interact.

P.S.
I was able to get one of the sample scripts in the examples directory to work accordingly:

python search.py "search index=pci_jbx_index * | head 10" --host=a.b.c.d --username="abc" --password="def" --output_mode=csv --verbose=verbose

Thanks everyone in advance,
-Mohammad

[richgalloway · Accepted solution]

Yes, the runsearch.py script is failing because Splunk is not installed on the local system. Splunk-provided python includes modules specific to Splunk. You have a couple of options:

1) Install Splunk on the scripts VM. There is no cost to install the software. If you never run it there will be no licensing costs, either.
2) Copy the splunklib.py module from your Splunk system to the scripts VM. There may be other modules to copy as well, which you'll discover through trial-and-error.

[mhassan24]

Thanks Rich. That makes sense. I'll install it and let it automatically become the free edition after the trial expires