Splunk Dev

python version (and libraries) installed with a lightweight forwarder for running Scripted Inputs?

Justin_Grant
Contributor

What version of Python is used to run Splunk 4.1.x. scripted inputs?

Which Python libraries are available for use in scripted inputs-- and which libraries (of those which I might normally expect to be available) are not available?

Which libraries (if any) have been modified by Splunk and so have different behavior than I'd expect from a regular Python distro?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The exact version varies with the exact version of Splunk, but for Splunk 4.1 thru 4.1.2, the version is 2.6.4. You can expect with later versions that there may be later 2.x Python. You can tell for any version by just running $SPLUNK_HOME/bin/splunk cmd python --version. I do not know if or when we will include Python 3.0 with Splunk instead, but it is likely that we will be sticking with 2.x for a very long time.

All Python standard libraries are included. Additionally, you can see what comes with Splunk by looking in $SPLUNK_HOME/lib/python2.6/site-packages (%SPLUNK_HOME\Python-2.6\Lib\site-packages on Windows. However, it can not be guaranteed that all packages shipped with Splunk will continue to be available in all future versions.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The exact version varies with the exact version of Splunk, but for Splunk 4.1 thru 4.1.2, the version is 2.6.4. You can expect with later versions that there may be later 2.x Python. You can tell for any version by just running $SPLUNK_HOME/bin/splunk cmd python --version. I do not know if or when we will include Python 3.0 with Splunk instead, but it is likely that we will be sticking with 2.x for a very long time.

All Python standard libraries are included. Additionally, you can see what comes with Splunk by looking in $SPLUNK_HOME/lib/python2.6/site-packages (%SPLUNK_HOME\Python-2.6\Lib\site-packages on Windows. However, it can not be guaranteed that all packages shipped with Splunk will continue to be available in all future versions.

Lowell
Super Champion

Just FYI. The full distutils are not available out of the box. This really only matters if you are trying to build python packages. (I'm a little bit unclear which parts of distutils are part of the "standard libraries" and which parts are not, I just know that running python setup.py build doesn't work out of the box.)

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...