Need help with splunk-sdk-python?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

526 Stars 305 Forks Apache License 2.0 1.3K Commits 77 Opened issues


Splunk Software Development Kit for Python

Services available


Need anything else?

Contributors list

Build Status Documentation Status

The Splunk Enterprise Software Development Kit for Python

Version 1.6.15

The Splunk Enterprise Software Development Kit (SDK) for Python contains library code and examples designed to enable developers to build applications using the Splunk platform.

The Splunk platform is a search engine and analytic environment that uses a distributed map-reduce architecture to efficiently index, search, and process large time-varying data sets.

The Splunk platform is popular with system administrators for aggregation and monitoring of IT machine data, security, compliance, and a wide variety of other scenarios that share a requirement to efficiently index, search, analyze, and generate real-time notifications from large volumes of time-series data.

The Splunk developer platform enables developers to take advantage of the same technology used by the Splunk platform to build exciting new applications.

Getting started with the Splunk SDK for Python

Get started with the Splunk Enterprise SDK for Python

The Splunk Enterprise SDK for Python contains library code and examples that show how to programmatically interact with the Splunk platform for a variety of scenarios including searching, saved searches, data inputs, and many more, along with building complete applications.


Here's what you need to get going with the Splunk Enterprise SDK for Python.

  • Python 2.7+ or Python 3.7.

The Splunk Enterprise SDK for Python has been tested with Python v2.7 and v3.7.

  • Splunk Enterprise

If you haven't already installed Splunk Enterprise, download it here. For more information, see the Splunk Enterprise Installation Manual.

  • Splunk Enterprise SDK for Python

Get the Splunk Enterprise SDK for Python from PyPI. If you want to contribute to the SDK, clone the repository from GitHub.

Install the SDK

Use the following commands to install the Splunk Enterprise SDK for Python libraries in different ways. However, it's not necessary to install the libraries to run the examples and unit tests from the SDK.


[sudo] easy_install splunk-sdk


[sudo] pip install splunk-sdk

Install the Python egg:

[sudo] pip install --egg splunk-sdk

Install the sources you cloned from GitHub:

[sudo] python install

Testing Quickstart

You'll need

to get up and running using this method.
make up SPLUNK_VERSION=8.0
make wait_up
make splunkrc_default
make test
make down

To run the examples and unit tests, you must put the root of the SDK on your PYTHONPATH. For example, if you downloaded the SDK to your home folder and are running OS X or Linux, add the following line to your .bash_profile file:

export PYTHONPATH=~/splunk-sdk-python

The SDK command-line examples require a common set of arguments that specify the host, port, and login credentials for Splunk Enterprise. For a full list of command-line arguments, include

as an argument to any of the examples.

Create a .splunkrc convenience file

To connect to Splunk Enterprise, many of the SDK examples and unit tests take command-line arguments that specify values for the host, port, and login credentials for Splunk Enterprise. For convenience during development, you can store these arguments as key-value pairs in a text file named .splunkrc. Then, the SDK examples and unit tests use the values from the .splunkrc file when you don't specify them.

Note: Storing login credentials in the .splunkrc file is only for convenience during development. This file isn't part of the Splunk platform and shouldn't be used for storing user credentials for production. And, if you're at all concerned about the security of your credentials, enter them at the command line rather than saving them in this file.

To use this convenience file, create a text file with the following format:

# Splunk Enterprise host (default: localhost)
# Splunk Enterprise admin port (default: 8089)
# Splunk Enterprise username
# Splunk Enterprise password
# Access scheme (default: https)
# Your version of Splunk Enterprise

Save the file as .splunkrc in the current user's home directory.

  • For example on OS X, save the file as:

  • On Windows, save the file as:


    You might get errors in Windows when you try to name the file because ".splunkrc" appears to be a nameless file with an extension. You can use the command line to create this file by going to the C:\Users\<currentusername> directory and entering the following command:

    Notepad.exe .splunkrc

    Click Yes, then continue creating the file.

Run the examples

Examples are located in the /splunk-sdk-python/examples directory. To run the examples at the command line, use the Python interpreter and include any arguments that are required by the example:

python --username="admin" --password="changeme"

If you saved your login credentials in the .splunkrc file, you can omit those arguments:


To get help for an example, use the

argument with an example:
python --help

Run the unit tests

The Splunk Enterprise SDK for Python contains a collection of unit tests. To run them, open a command prompt in the /splunk-sdk-python directory and enter:


You can also run individual test files, which are located in /splunk-sdk-python/tests. To run a specific test, enter:

make specific_test_name

The test suite uses Python's standard library, the built-in

, and

Notes: * The test run fails unless the SDK App Collection app is installed. * To exclude app-specific tests, use the

make test_no_app
command. * To learn about our testing framework, see Splunk Test Suite on GitHub. In addition, the test run requires you to build the searchcommands app. The
command runs the tasks to do this, but more complex testing may require you to rebuild using the
make build_app


| Directory | Description | |:--------- |:---------------------------------------------------------- | |/docs | Source for Sphinx-based docs and build | |/examples | Examples demonstrating various SDK features | |/splunklib | Source for the Splunk library modules | |/tests | Source for unit tests | |/utils | Source for utilities shared by the examples and unit tests |


The CHANGELOG contains a description of changes for each version of the SDK. For the latest version, see the on GitHub.


The master branch represents a stable and released version of the SDK. To learn about our branching model, see Branching Model on GitHub.

Documentation and resources

| Resource | Description | |:----------------------- |:----------- | | Splunk Developer Portal | General developer documentation, tools, and examples | | Integrate the Splunk platform using development tools for Python| Documentation for Python development | | Splunk Enterprise SDK for Python Reference | SDK API reference documentation | | REST API Reference Manual | Splunk REST API reference documentation | | Splunk>Docs | General documentation for the Splunk platform | | GitHub Wiki | Documentation for this SDK's repository on GitHub |


Stay connected with other developers building on the Splunk platform.


If you would like to contribute to the SDK, see Contributing to Splunk. For additional guidelines, see CONTRIBUTING.


  • You will be granted support if you or your company are already covered under an existing maintenance/support agreement. Submit a new case in the Support Portal and include "Splunk Enterprise SDK for Python" in the subject line.

If you are not covered under an existing maintenance/support agreement, you can find help through the broader community at Splunk Answers.

  • Splunk will NOT provide support for SDKs if the core library (the code in the /splunklib directory) has been modified. If you modify an SDK and want support, you can find help through the broader community and Splunk Answers.

We would also like to know why you modified the core library, so please send feedback to [email protected].

Contact Us

You can reach the Splunk Developer Platform team at [email protected].


The Splunk Enterprise Software Development Kit for Python is licensed under the Apache License 2.0. See LICENSE for details.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.