Building for the Splunk Platform

On Linux how to allow non-root users to use the splunklib Python module

sillingworth
Path Finder

After installing splunksdk on a linux server only the root user could import splunklib, other users would get

"ImportError: No module named splunklib.client" *(or .results, etc)*

The module had installed itself in:

/lib/python2.7/site-packages/setuptools-0.9.8-py2.7.egg-info

I've got it working now and will post an answer so people searching for the same issue can find it, but I'm not really happy with it - seems like a fudge. I'd like to know what people think: is this intended behaviour? Is there a better fix? Is this a mistake by Splunk, or by the people who wrote the distro or configured my server (it's running Oracle Linux Server 7), or potentially a mistake I made installing the module (if I recall correctly it was just a case of, as root, extracting the archive then running python setup.py install)?

Tags (1)
0 Karma

sillingworth
Path Finder

My solution, which works but seems less than ideal, was:

in /lib/python2.7/site-packages/:

chmod -R 755 setuptools-0.9.8-py2.7.egg-info
ln -s setuptools-0.9.8-py2.7.egg-info/splunklib splunklib
0 Karma

sillingworth
Path Finder

The fact I had to do the chmod I think points to a server config issue, probably the umask, but the second issue seems very strange. So root was looking inside setuptools-0.9.8-py2.7.egg-info whereas other users weren't. I have no idea why this would be.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...