Install & Compatibility
Where this runs
tested against v2.1.1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 0.154s · 21.1MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 2.5s · import 0.144s · 22MB
19MB installed
● package 19MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
client
✓ import splunklib.client as client
The `splunklib.client` module is the primary entry point for connecting to a Splunk instance and accessing its resources.
This quickstart demonstrates how to connect to a Splunk Enterprise instance using username and password authentication, and then lists the installed applications. It uses environment variables for credentials, which is a common practice for security.
import os
import splunklib.client as client
# Configure connection details using environment variables or replace directly
HOST = os.environ.get('SPLUNK_HOST', 'localhost')
PORT = int(os.environ.get('SPLUNK_PORT', 8089))
USERNAME = os.environ.get('SPLUNK_USERNAME', 'admin')
PASSWORD = os.environ.get('SPLUNK_PASSWORD', 'your_password') # Use a strong password or token in production
try:
# Connect to Splunk
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD,
autologin=True,
# Set verify=False for self-signed certificates in development, but not recommended for production
# verify=False # Example: os.environ.get('SPLUNK_SSL_VERIFY', 'true').lower() == 'true'
)
# Print connected user and Splunk version
print(f"Connected as: {service.username}")
print(f"Splunk version: {service.info['version']}")
# List available apps
print("\nAvailable apps:")
for app in service.apps:
print(f"- {app.name}")
except Exception as e:
print(f"Error connecting to Splunk: {e}")
print("Please ensure Splunk is running and connection details (host, port, username, password) are correct.")
print("For self-signed certificates, you might need to set verify=False (not recommended for production).")
Debug
Known issues
breakingVersion 2.0.0 removed all Python 2 compatibility, including the `six.py` dependency and `__future__` imports. Applications developed for Python 2 using older SDK versions will break.fixMigrate your code to Python 3 and ensure all dependencies are Python 3 compatible. Review the 2.0.0 release notes for specific changes.
affects: >=2.0.0
breakingSplunk Enterprise 10.0 (and later) has deprecated and deactivated Search API v1.0 endpoints, urging migration to Search API v2.0. Applications relying on older SDK methods that implicitly use v1.0 may encounter breaking changes when connecting to newer Splunk instances.fixReview Splunk's API documentation for Search API v2.0 and update your SDK usage accordingly to ensure compatibility with modern Splunk Enterprise versions.
affects: >=2.0.0 (when interacting with Splunk Enterprise >=10.0)
deprecatedThe `wrap_socket` method in the `Context` class was deprecated and subsequently removed in version 2.1.0.fixRemove any usage of `wrap_socket`. Implement custom HTTP handlers if specific socket wrapping functionality is required.
affects: >=2.1.0 (removal)
gotchaConnecting to Splunk using HTTPS with self-signed certificates might lead to SSL verification errors. While explicit support for self-signed certificates was added in 2.1.0, developers might still need to configure the `verify` parameter in `client.connect` (e.g., set to `False` for testing) or properly manage certificates. Setting `verify=False` is not recommended for production environments.fixFor production, ensure valid SSL certificates are used or configure certificate trust appropriately. For development/testing with self-signed certs, set `verify=False` in `client.connect` with caution.
affects: All
gotchaThe SDK's `.env` file for storing connection credentials is strictly for development convenience and should NOT be used for production credentials due to security risks.fixFor production deployments, use secure methods for credential management, such as environment variables, secrets management services, or Splunk's built-in authentication mechanisms (e.g., bearer tokens, session keys) directly in your application code.
affects: All
Errors
Common errors & fixes
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain
The Splunk SDK's underlying HTTP client attempts to verify the SSL certificate of the Splunk server, which fails when the server uses a self-signed certificate or one from an untrusted Certificate Authority.
fixDisable SSL certificate verification by passing `verify=False` to the `splunk.client.connect()` method. For production environments, it is recommended to configure proper CA-signed certificates or ensure the CA certificate is trusted by the system.
ModuleNotFoundError: No module named 'splunklib'
The current version of the Splunk SDK for Python installs under the package name `splunk`, not `splunklib`. This error often occurs when following outdated examples or documentation.
fixUpdate your import statements to use `import splunk.client` instead of `import splunklib.client` or similar `splunklib` imports.
splunk.SplunkdError: HTTP 400 Bad Request -- Error in 'search' command: The search string must be specified.
This error occurs when attempting to create a search job with an empty or invalid search query string, or when the Splunk server rejects the search due to syntax issues or missing parameters.
fixEnsure that the search query passed to `service.jobs.create()` is a non-empty, valid Splunk Processing Language (SPL) string. Double-check the SPL syntax for correctness.
AttributeError: 'Jobs' object has no attribute 'oneshot'
The Splunk SDK does not expose a direct `oneshot()` method on the `Jobs` collection. One-shot searches are performed by passing the `exec_mode='oneshot'` argument to the `service.jobs.create()` method.
fixUse the `service.jobs.create()` method with `exec_mode='oneshot'` to execute a one-shot search job.
splunk.RESTException: [HTTP 401] Unauthorized
The provided username or password for connecting to the Splunk instance is incorrect, or the user lacks sufficient permissions.
fixVerify the username and password are correct and ensure the user has appropriate roles and capabilities in Splunk.
Upgrade
Version history
3.0.0latest on PyPI · released May 12, 2026
Audit
Dependencies
deprecationrequiredUsed for handling deprecation warnings within the SDK. It was explicitly moved as a dependency in version 2.0.1.