You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+48-80Lines changed: 48 additions & 80 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,17 +25,15 @@ For more information, see the Splunk Enterprise [Installation Manual](https://do
25
25
26
26
### Installing the SDK
27
27
28
-
[uv](https://docs.astral.sh/uv/) is our tool of choice for development. Usually that means creating a project with `uv init` and installing the SDK with `uv add splunk-sdk`. When in doubt, consult `uv` docs.
29
-
30
-
If you prefer not using `uv`, the standard Python package installation method still works:
28
+
Refer to standard Python package installation methods.
31
29
32
30
```sh
33
31
python -m venv .venv
34
32
source .venv/bin/activate
35
33
python -m pip install splunk-sdk
36
34
```
37
35
38
-
#### Create an .env file (optional)
36
+
#### Optional: Create an `.env` file
39
37
40
38
To connect to Splunk Enterprise, many of the SDK examples and unit tests take command-line arguments that specify values for the host, port, and authentication. For convenience during development, you can store these arguments as key-value pairs in a `.env` file.
41
39
@@ -80,27 +78,13 @@ service = client.connect(host=<HOST_URL>, token=<SESSION_KEY>, autologin=True)
80
78
When working with custom search commands such as Custom Streaming Commands or Custom Generating Commands, we may need to add new fields to the records based on certain conditions. Structural changes like this may not be preserved.
81
79
If you're having issues with field retention, make sure to use `add_field(record, fieldname, value)` method from SearchCommand to add a new field and value to the record.
82
80
83
-
<!-- TODO: Change this to a diff -->
84
-
85
-
#### Do
86
-
87
-
```python
81
+
```diff
88
82
class CustomStreamingCommand(StreamingCommand):
89
83
def stream(self, records):
90
84
for index, record in enumerate(records):
91
85
if index % 1 == 0:
92
-
self.add_field(record, "odd_record", "true")
93
-
yield record
94
-
```
95
-
96
-
#### Don't
97
-
98
-
```python
99
-
classCustomStreamingCommand(StreamingCommand):
100
-
defstream(self, records):
101
-
for index, record inenumerate(records):
102
-
if index %1==0:
103
-
record["odd_record"] ="true"
86
+
- record["odd_record"] = "true"
87
+
+ self.add_field(record, "odd_record", "true")
104
88
yield record
105
89
```
106
90
@@ -109,104 +93,91 @@ class CustomStreamingCommand(StreamingCommand):
109
93
- Generating Custom Search Command is used to generate events using SDK code.
110
94
- Make sure to use `gen_record()` method from SearchCommand to add a new record and pass event data as comma-separated key=value pairs (mentioned in below example).
111
95
112
-
<!-- TODO: Change this to a diff -->
113
-
114
-
Do
115
-
116
-
```python
96
+
```diff
117
97
@Configuration()
118
98
class GeneratorTest(GeneratingCommand):
119
99
def generate(self):
120
-
yieldself.gen_record(_time=time.time(), one=1)
121
-
yieldself.gen_record(_time=time.time(), two=2)
122
-
```
100
+
- yield {'_time': time.time(), 'one': 1}
101
+
- yield {'_time': time.time(), 'two': 2}
102
+
+ yield self.gen_record(_time=time.time(), one=1)
103
+
+ yield self.gen_record(_time=time.time(), two=2)
123
104
124
-
Don't
125
-
126
-
```python
127
-
@Configuration()
128
-
classGeneratorTest(GeneratingCommand):
129
-
defgenerate(self):
130
-
yield {'_time': time.time(), 'one': 1}
131
-
yield {'_time': time.time(), 'two': 2}
132
105
```
133
106
134
107
### Access metadata of Modular Inputs app example
135
108
136
109
- In `stream_events()` one can access modular input app metadata from `InputDefinition` object
137
-
- See [GitHub Commit](https://github.com/splunk/splunk-app-examples/blob/master/modularinputs/python/github_commits/bin/github_commits.py) Modular Input App example for reference.
110
+
- See the [Modular Input App example](https://github.com/splunk/splunk-app-examples/blob/master/modularinputs/python/github_commits/bin/github_commits.py) for reference.
138
111
139
112
```python
140
113
defstream_events(self, inputs, ew):
141
-
# [...] other code
114
+
# [...]
142
115
143
-
# Access metadata (like server_host, server_uri, etc) of modular inputs app from InputDefinition object
144
-
# Here, an InputDefinition`object data is used
116
+
# Access the modular input app's metadata (like server_host, server_uri, etc) from `InputDefinition` object
- The service object is created from the `splunkd` URI and session key passed to the command invocation the search results info file.
155
-
- Service object can be accessed using `self.service` in `generate`/`transform`/`stream`/`reduce` methods depending on the Custom Search Command.
156
-
157
-
##### Getting Splunk instance metadata
126
+
- The `service` metadata object is created from the `splunkd` URI and session key passed to the command invocation the search results info file and is available in `MyCommand`.`generate`/`transform`/`stream`/`reduce` methods depending on the Custom Search Command.
158
127
159
128
```python
160
-
defget_metadata(self):
161
-
# [...] other code
162
-
163
-
# Access service object that can be used to connect Splunk Service
164
-
service =self.service
165
-
# Getting Splunk Service Info
166
-
info = service.info
129
+
from splunklib.searchcommands import StreamingCommand
130
+
131
+
classMyCommand(StreamingCommand):
132
+
defget_metadata(self):
133
+
# Access instance metadata
134
+
service =self.service
135
+
# Access Splunk service info
136
+
info = service.info
137
+
# [...]
167
138
```
168
139
169
140
#### Modular Inputs app
170
141
171
-
- The service object is created from the `splunkd` URI and session key passed to the command invocation on the modular input stream respectively.
172
-
- It is available as soon as the `Script.stream_events` method is called.
173
-
174
-
```python
175
-
defstream_events(self, inputs, ew):
176
-
# other code
177
-
178
-
# access service object that can be used to connect Splunk Service
179
-
service =self.service
180
-
# to get Splunk Service Info
181
-
info = service.info
182
-
```
142
+
- The `service` metadata object is created from the `splunkd` URI and session key passed to the command invocation on the modular input stream respectively, and is available as soon as the `MyScript.stream_events` method is called.
183
143
184
-
### Running the test suite
185
-
186
-
This repo contains a collection of unit and integration tests.
144
+
```python
145
+
from splunklib.modularinput import Script
146
+
147
+
classMyScript(Script):
148
+
defstream_events(self, inputs, ew):
149
+
# Access instance metadata
150
+
service =self.service
151
+
# Access Splunk service info
152
+
info = service.info
153
+
# [...]
154
+
```
187
155
188
-
#### Unit tests
156
+
###Testing
189
157
190
-
To run both unit and integration tests:
158
+
This repo contains a collection of both unit and integration tests. The latter need `docker`/`podman` to work.
191
159
192
160
```sh
161
+
# Run the entire test suite:
162
+
make test
163
+
# Run only the unit tests:
193
164
make test-unit
194
165
```
195
166
196
167
#### Integration tests
197
168
198
169
> NOTE: Before running the integration tests, make sure the instance of Splunk you are testing against doesn't have new events being dumped continuously into it. Several of the tests rely on a stable event count. It's best to test against a clean install of Splunk but if you can't, you should at least disable the \*NIX and Windows apps.
199
170
200
-
Do not run the test suite against a production instance of Splunk! It will run just fine with the free Splunk license.
201
-
202
-
##### Prerequisites
203
-
204
-
-`docker`/`podman`
205
-
206
171
```sh
207
-
SPLUNK_VERSION=latest && make docker-start
172
+
# Make sure a local Splunk instance is running
173
+
SPLUNK_VERSION=latest make docker-start
174
+
175
+
# Run the integration tests:
176
+
make test-integration
208
177
```
209
178
179
+
> Do not run the test suite against a production instance of Splunk! It will run just fine with the free Splunk license.
180
+
210
181
### Optional: Set up logging for splunklib
211
182
212
183
The default level is WARNING, which means that only events of this level and above will be visible
@@ -228,9 +199,6 @@ The [CHANGELOG](CHANGELOG.md) contains a description of changes for each version
228
199
229
200
### Branches
230
201
231
-
The `master` branch represents a stable and released version of the SDK.
232
-
`develop` is where development between releases is happening.
233
-
234
202
To learn more about our branching model, see [Branching Model](https://github.com/splunk/splunk-sdk-python/wiki/Branching-Model) on GitHub.
0 commit comments