Whats the difference between splunklib.* and splunk.Intersplunk

[spammenot66]

I've noticed a bunch of custom search command uses splunk.Intersplunk. In the Python Splunk SDK it documents splunklib.*. Can someone provide some details on what the difference between these two libraries are? When should we use one over the other?

[badarsebard · Accepted solution]

The difference is between two versions of how to create a custom command in Splunk. The splunk.Intersplunk module is a relatively simple module baked into the Splunk Python distribution and is the version 1 style of creating custom commands that has been around since about Splunk 3.x. The splunklib package is the Splunk SDK for Python found here: http://dev.splunk.com/python. The SDK provides lots of tools for doing lots of things, including the new version 2 of how to create custom commands. There are lots of advantages to using the version 2 approach but that does come at the cost of bundling the SDK into your app. However, most agree it's worth it and it is considered best practice. There is an excellent .conf talk about the differences between the two here: https://conf.splunk.com/files/2017/slides/extending-spl-with-custom-search-commands-and-the-splunk-s....

[spammenot66]

thanks badarsebard!