Splunk Dev

Whats the difference between splunklib.* and splunk.Intersplunk

spammenot66
Contributor

I've noticed a bunch of custom search command uses splunk.Intersplunk. In the Python Splunk SDK it documents splunklib.*. Can someone provide some details on what the difference between these two libraries are? When should we use one over the other?

1 Solution

badarsebard
Communicator

The difference is between two versions of how to create a custom command in Splunk. The splunk.Intersplunk module is a relatively simple module baked into the Splunk Python distribution and is the version 1 style of creating custom commands that has been around since about Splunk 3.x. The splunklib package is the Splunk SDK for Python found here: http://dev.splunk.com/python. The SDK provides lots of tools for doing lots of things, including the new version 2 of how to create custom commands. There are lots of advantages to using the version 2 approach but that does come at the cost of bundling the SDK into your app. However, most agree it's worth it and it is considered best practice. There is an excellent .conf talk about the differences between the two here: https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-s....

View solution in original post

badarsebard
Communicator

The difference is between two versions of how to create a custom command in Splunk. The splunk.Intersplunk module is a relatively simple module baked into the Splunk Python distribution and is the version 1 style of creating custom commands that has been around since about Splunk 3.x. The splunklib package is the Splunk SDK for Python found here: http://dev.splunk.com/python. The SDK provides lots of tools for doing lots of things, including the new version 2 of how to create custom commands. There are lots of advantages to using the version 2 approach but that does come at the cost of bundling the SDK into your app. However, most agree it's worth it and it is considered best practice. There is an excellent .conf talk about the differences between the two here: https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-s....

spammenot66
Contributor

thanks badarsebard!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...