New functionality: AI with Splunk Apps

This release enables integrating LLMs with Splunk Apps. We worked ourselves to the bone to implement this functionality the best we could and are very excited to see what you build with it!

Take a look at ai/README.md to learn more about it.

What's Changed

• Bump actions/setup-python from 9322b3ca74000aeb2c01eb777b646334015ddd72 to 65b071217a8539818fdb8b54561bcbae40380a54 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/654
• Always call sleep while restarting by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/649
• Add space before username in restart required message by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/655
• Bump actions/setup-python from 65b071217a8539818fdb8b54561bcbae40380a54 to 3d1e2d2ca0a067f27da6fec484fce7f5256def85 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/657
• Test using macros directly in an SPL query by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/658
• Add tests for macro permissions by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/659
• Modernize project to use pyproject.toml, review .gitignore and untrack any ignored files, update README by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/660
• Update version to 2.2.0 alpha, fix Trusted Publishing by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/663
• Bump actions/setup-python from 3d1e2d2ca0a067f27da6fec484fce7f5256def85 to e797f83bcb11b83ae66e0230d6156d7c80228e7c by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/666
• Bump pypa/gh-action-pypi-publish from d417ba7e7683fa9104c42abe611c1f2c93c0727d to ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/665
• Give Splunk some more time after a restart by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/668
• Resolve warnings emitted by tests by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/667
• Document key_file, cert_file, context params. by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/672
• Don't specify Host header explicitly by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/673
• SDK-21 add deps of test apps into bin/ by @cecyliaborek in https://github.com/splunk/splunk-sdk-python/pull/671
• Remove ResultsReader, six by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/670
• Replace tox with pytest and Makefile, cleanup in docs/Makefile by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/669
• Bump actions/upload-artifact from de65e23aa2b7e23d713bb51fbfcb6d502f8667d8 to 2848b2cda0e5190984587ec6bb1f36730ca78d50 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/676
• Support self.service in ModularInput's validate_input by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/682
• Expose published and author fields by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/681
• Deflake test_published_author_fields by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/684
• Bump actions/checkout from ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 to 71cf2267d89c5cb81562390fa70a37fa40b1305e by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/686
• Bump actions/upload-artifact from 2848b2cda0e5190984587ec6bb1f36730ca78d50 to 330a01c490aca151604b8cf639adc76d48f6c5d4 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/680
• Support setting string body in the generic request method by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/683
• Bump actions/setup-python from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/689
• Add patch and put methods to the service by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/693
• Bump actions/checkout from 6.pre.beta to 6.0.2 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/696
• Bump actions/setup-python from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/697
• Adjust top-level comments in all files by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/699
• Fix test_list_with_sort_dir by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/703
• Support all ML-KEM key exchange algorithms by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/702
• Deprecate the encr_password field from storage/passwords by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/695
• Bump actions/upload-artifact from 5.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/splunk/splunk-sdk-python/pull/700
• Add Python scans to Dependabot by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/707
• Upstream updates to some workflows by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/708
• Remove Fossa by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/709
• Merge develop to develop-3.0 by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/716
• Reverse-merge develop-3.0 into develop by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/714
• Bump packages in pyproject.toml by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/725
• Change ToolResult.content to str by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/723
• Restrict subagent names by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/722
• Fix splunklib/ai/README.md by @szykol in https://github.com/splunk/splunk-sdk-python/pull/728
• Turn off Dependabot for the time being by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/735
• Add FOSSA badge to README by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/736
• Add AppInspect CI stage by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/730
• Fix MCP Server App download script by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/739
• Change AgentState.response to AgentState.messages by @splunk-dtaborski in https://github.com/splunk/splunk-sdk-python/pull/743
• Snapshot record then reply testing by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/740
• Improve handling AIMessage.content by @szykol in https://github.com/splunk/splunk-sdk-python/pull/741
• Make id required (non-nullable) for tool/subagent/output calls by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/724
• Uncomment dependabot config by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/745
• Group dependabot updates by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/752
• Disallow running Agents using system user by @szykol in https://github.com/splunk/splunk-sdk-python/pull/753
• Explicitly set type in every LC_ToolCall by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/760
• Set kw_only=True in all dataclasses by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/758
• Add thread_id to middlewares by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/755
• Use keyed parameters in SubagentTextResult constructor by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/763
• test: Pass fake api_key to the internal ai model by @szykol in https://github.com/splunk/splunk-sdk-python/pull/764
• Prepare for Beta release by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/731
• Add StructuredOutputRetryLimitMiddleware and default retry limit by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/756
• Use thread_ids in TimeoutLimitMiddleware by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/757
• Move limit middlewares from splunklib.ai.hooks to splunklib.ai.limits by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/759
• Add GoogleModel support by @szykol in https://github.com/splunk/splunk-sdk-python/pull/727
• Make sure default middlewares are always ordered in the same order by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/766
• Run ruff format on repo by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/744
• CD adjustments again by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/767
• Remove commit SHA from the version pushed to Test PyPI by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/772
• CD adjustments again, again by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/774
• Make limits as settings instead of implicit middlewares by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/769
• Remove total_steps and token_count from AgentState by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/770
• Add test for SystemMessage by @mateusz834 in https://github.com/splunk/splunk-sdk-python/pull/775
• Fix Fossa badge in README by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/776
• Introduce validating version field against git tag by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/779
• Minor release adjustments by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/781
• Fix wrong braces in release step by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/783
• Fix wrong API endpoint for official PyPI by @Ickerday in https://github.com/splunk/splunk-sdk-python/pull/784

New Contributors

• @dependabot[bot] made their first contribution in https://github.com/splunk/splunk-sdk-python/pull/654
• @szykol made their first contribution in https://github.com/splunk/splunk-sdk-python/pull/728
• @splunk-dtaborski made their first contribution in https://github.com/splunk/splunk-sdk-python/pull/743

Full Changelog: https://github.com/splunk/splunk-sdk-python/compare/2.1.1...3.0.0

Changes

• #623 Additional logging in custom search commands
• #622 Check if developer added custom map method in reporting command
• Code reformatting and linting, improvements to github acitons

• #516 Added support for macros
• Remove deprecated wrap_socket in Contex class.
• Added explicit support for self signed certificates in https
• Enforce minimal required tls version in https connection
• Add support for python 3.13
• #559 Add exception logging

Version 2.0.2

Minor changes

• Added six.py file back

Version 2.0.1

Bug fixes

• #567 Moved "deprecation" dependency

Version 2.0.0

Feature updates

• ensure_binary, ensure_str and assert_regex utility methods have been migrated from six.py to splunklib/utils.py

Major changes

• Removed code specific to Python 2
• Removed six.py dependency
• Removed __future__ imports
• Refactored and Updated splunklib and tests to utilize Python 3 features
• Updated CI test matrix to run with Python versions - 3.7 and 3.9
• Refactored Code throwing deprecation warnings
• Refactored Code violating Pylint rules

Bug fixes

• #527 Added check for user roles
• Fix to access the metadata "finished" field in search commands using the v2 protocol
• Fix for error messages about ChunkedExternProcessor in splunkd.log for Custom Search Commands

Version 1.7.4

Bug fixes

• #532 update encoding errors mode to 'replace' [issue#505]
• #507 masked sensitive data in logs [issue#506]

Minor changes

• #530 Update GitHub CI build status in README and removed RTD(Read The Docs) reference

Version 1.7.3

Bug fixes

• #493 Fixed file permission for event_writer.py file [issue#487]
• #500 Replaced index_field with accelerated_field for kvstore [issue#497]
• #502 Updated check for IPv6 addresses

Minor changes

• #490 Added ACL properties update feature
• #495 Added Splunk 8.1 in GitHub Actions Matrix
• #485 Added test case for cookie persistence
• #503 README updates on accessing "service" instance in CSC and ModularInput apps
• #504 Updated authentication token names in docs to reduce confusion
• #494 Reuse splunklib.version in handler.request

Version 1.7.2

Minor changes

• #482 Special handling related to the semantic versioning of specific Search APIs functional in Splunk Enterprise 9.0.2 and (Splunk Cloud 9.0.2209). These SDK changes will enable seamless transition between the APIs based on the version of the Splunk Enterprise in use

Version 1.7.1

Bug fixes

• #471 Fixed support of Load Balancer "sticky sessions" (persistent cookies) [issue#438]

Minor changes

• #466 tests for CSC apps
• #467 Added 'kwargs' parameter for Saved Search History function
• #475 README updates

Version 1.7.0

New features and APIs

• #468 SDK Support for splunkd search API changes

Bug fixes

• #464 updated checks for wildcards in StoragePasswords [issue#458]

Minor changes

• #463 Preserve thirdparty cookies

Version 1.6.20

New features and APIs

• #442 Optional retries feature added
• #447 Create job support for "output_mode:json" [issue#285]

Bug fixes

• #449 Set cookie [issue#438]
• #460 Remove restart from client.Entity.disable

Minor changes

• #444 Update tox.ini
• #446 Release workflow refactor
• #448 Documentation changes
• #450 Removed examples and it's references from the SDK

Full Changelog: https://github.com/splunk/splunk-sdk-python/compare/1.6.19...1.6.20

New features and APIs

• #441 JSONResultsReader added and deprecated ResultsReader
  • Pre-requisite: Query parameter 'output_mode' must be set to 'json'
  • Improves performance by approx ~80-90%
  • ResultsReader is deprecated and will be removed in future releases (NOTE: Please migrate to JSONResultsReader)
• #437 added setup_logging() method in splunklib for logging
• #426 Added new github_commit modular input example
• #392 Break out search argument to option parsing for v2 custom search commands
• #384 Added Float parameter validator for custom search commands
• #371 Modinput preserve 'app' context

Bug fixes

• #439 Modified POST method debug log to not log sensitive body/data
• #431 Add distsearch.conf to Stream Search Command examples [ issue#418 ]
• #419 Hec endpoint issue[ issue#345 ]
• #416 Removed strip() method in load_value() method from data.py file [ issue#400 ]
• #148 Identical entity names will cause an infinite loop

Minor changes

• #440 Github release workflow modified to generate docs
• #430 Fix indentation in README
• #429 documented how to access modular input metadata
• #427 Replace .splunkrc with .env file in test and examples
• #424 Float validator test fix
• #423 Python3 compatibility for ResponseReader.str()
• #422 ordereddict and all its reference removed
• #421 Update README.md
• #387 Update filter.py
• #331 Fix a couple of warnings spotted when running python 2.7 tests
• #330 client: use six.string_types instead of basestring
• #329 client: remove outdated comment in Index.submit
• #262 properly add parameters to request based on the method of the request
• #237 Don't output close tags if you haven't written a start tag
• #149 "handlers" stanza missing in examples/searchcommands_template/default/logging.conf

Version 1.6.18

Bug fixes

• #405 Fix searchcommands_app example
• #406 Fix mod inputs examples
• #407 Fixed issue with Streaming and Generating Custom Search Commands dropping fields that aren't present in the first row of results. More details on how to opt-in to this fix can be found here: https://github.com/splunk/splunk-sdk-python/blob/develop/README.md#customization [ issue#401 ]

Minor changes

• #408 Add search mode example
• #409 Add Support for authorization tokens read from .splunkrc [ issue#388 ]
• #413 Default kvstore owner to nobody [ issue#231 ]

Version 1.6.17

Bug fixes

• #383 Implemented the possibility to provide a SSLContext object to the connect method
• #396 Updated KVStore Methods to support dictionaries
• #397 Added code changes for encoding '/' in _key parameter in kvstore.data APIs.
• #398 Added dictionary support for KVStore "query" methods.
• #402 Fixed regression introduced in 1.6.15 to once again allow processing of empty input records in custom search commands (fix #376)
• #404 Fixed test case failure for 8.0 and latest(8.2.x) splunk version

Minor changes

• #381 Updated current year in conf.py
• #389 Fixed few typos
• #391 Fixed spelling error in client.py
• #393 Updated development status past 3
• #394 Updated Readme steps to run examples
• #395 Updated random_number.py
• #399 Moved CI tests to GitHub Actions
• #403 Removed usage of Easy_install to install SDK

Version 1.6.16

Bug fixes

#312 Fix issue #309, avoid catastrophic backtracking in searchcommands

Version 1.6.15

Bug fixes

#301 Fix chunk synchronization (Issue https://github.com/splunk/splunk-sdk-python/issues/150) #327 Rename and cleanup follow-up for chunk synchronization #352 Allow supplying of a key-value body when calling Context.post() (Issue https://github.com/splunk/splunk-sdk-python/issues/207)

Minor changes

#350 Initial end-to-end tests for streaming, reporting, generating custom search commands #348 Update copyright years to 2020 #346 Readme updates to urls, terminology, and formatting #317 Fix deprecation warnings

Bug fix

• SearchCommand now correctly supports multibyte characters in Python 3.

Version 1.6.13

Bug fix

• https://github.com/splunk/splunk-sdk-python/issues/307 Fixed regression in mod inputs which resulted in error ’file' object has no attribute 'readable’, by not forcing to text/bytes in mod inputs event writer any longer.

Minor changes

• Minor updates to the splunklib search commands to support Python3

Version 1.6.12

New features and APIs

• Added Bearer token support using Splunk Token in v7.3
• Made modinput text consistent

Bug fixes

• Changed permissions from 755 to 644 for python files to pass appinspect checks
• Removed version check on ssl verify toggle

Known Issues

• Regression with modinputs tracked here: https://github.com/splunk/splunk-sdk-python/issues/307, we recommend using an earlier version of the SDK if modinputs are being used until the fix has been released

Version 1.6.11

Bug Fix

• Fix custom search command V2 failures on Windows for Python3

Version 1.6.10

Bug Fix

• Fix long type gets wrong values on windows for python 2

Version 1.6.9

Bug Fix

• Fix buffered input in python 3

Version 1.6.8

Bug Fix

• Fix custom search command on python 3 on windows

Version 1.6.7

Changes

• Updated the Splunk SDK for Python to work with the Python 3 version of Splunk Enterprise on Windows
• Improved the performance of deleting/updating an input
• Added logging to custom search commands app to showcase how to do logging in custom search commands by using the Splunk SDK for Python

Bug fixes

• Fix ssl verify to require certs when true

Minor changes

• Make the explorer example compatible w/ Python 3
• Add full support for unicode in SearchCommands
• Add return code for invalid_args block