Building for the Splunk Platform

Python SDK Best Practices

snayak_splunk
Splunk Employee
Splunk Employee

We are trying to develop an external application that pulls data from Splunk via the Python SDK.

We had a couple of questions.
whether we need to explicitly log-out of service calls (and if not what the implications are)

Service(_BaseService):
"""A Pythonic binding to Splunk instances

Do we need to explicitly logout of

self.service.logout()

we’re finding we’re needing to make a lot of splunk restarts to pick-up changes – any hints/tips/guidance on compiler interaction with Splunk (or even general Best Practice) would help!

Also, do we have some documented Best Practices for the Python SDK?

Any input would be greatly appreciated.

Tags (2)
0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee
  1. I think it was @mvanderlist_splunk who pointed out that the logout is not necessary since the session timeout should suffice and can be modified to constraint to your desired TTL.
  2. There are great tips on the _bump and /debug/refresh strategies, as well as how to customize other caching parameters that help minimize the need for any action documented at Customization options and caching. Just remember that if something doesn't seem to take effect through one of those approaches, always revert back to a classic restart rather than assuming it's broken - these approaches may not work 100% of all times you'd expect them to (simply because we expect too much lol).

View solution in original post

sloshburch
Splunk Employee
Splunk Employee
  1. I think it was @mvanderlist_splunk who pointed out that the logout is not necessary since the session timeout should suffice and can be modified to constraint to your desired TTL.
  2. There are great tips on the _bump and /debug/refresh strategies, as well as how to customize other caching parameters that help minimize the need for any action documented at Customization options and caching. Just remember that if something doesn't seem to take effect through one of those approaches, always revert back to a classic restart rather than assuming it's broken - these approaches may not work 100% of all times you'd expect them to (simply because we expect too much lol).

gjanders
SplunkTrust
SplunkTrust
0 Karma

sloshburch
Splunk Employee
Splunk Employee

Good catch @garethatiag - the period snuck in on the url. Should be fixed now.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...