Can I add python modules to the Splunk environment?

There's also a more upgrade-friendly way to accomplish this. Some of our users setup whichever script they've configured in Splunk as a pass-through to a script that runs using their system Python (with whichever custom modules they've installed).

The steps are roughly:

• configure your script in splunk (search script, scripted input, whatever)

• this script should:

  • unset PYTHONPATH (in os.environ)

  • perhaps unset LD_LIBRARY_PATH, depending on your environment (also in os.environ)

  • create a process to run /usr/bin/python (via subprocess)

  • redirect stdin, stdout, stderr to/from script2

script2 can then load any arbitrary python module installed in your system's python installation.

Updating your Splunk Python is not supported (by Splunk). The recommended method is to update your system's Python or install a 3rd copy of Python that is not located in your PATH.

Here is an example, tested on Linux and Windows, that uses a non-splunk python but still lets you load most Splunk modules:

wrapper.py:

import os
import subprocess

_NEW_PYTHON_PATH = '/usr/bin/python'
_SPLUNK_PYTHON_PATH = os.environ['PYTHONPATH']

os.environ['PYTHONPATH'] = _NEW_PYTHON_PATH 
my_process = os.path.join(os.getcwd(), 'my_script.py')

p = subprocess.Popen([os.environ['PYTHONPATH'], my_process, _SPLUNK_PYTHON_PATH], 
                      stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
output = p.communicate()[0]
print output

my_script.py:

import sys 
import os

#This step is necessary in order to load splunk packages
from optparse import OptionParser
parser = OptionParser()
(options, args) = parser.parse_args()
_SPLUNK_PYTHON_PATH = args[0]
sys.path.append(_SPLUNK_PYTHON_PATH)

import splunk
import cherrypy
import some_package_from_new_python
...

i have 3 pythons in my linux server, local 2.3, 2.5 and 2.6(in splunk4.0.8). I can not install MySQL-python-1.2.3c1 to 2.6, but it's ok to install it to local 2.3. the following is the detail.

cd MySQL-python-1.2.3c1

python2.6 setup.py build ImportError: No module named setuptools

sh setuptools-0.6c11-py2.6.egg ImportError: No module named command.bdist

[root@localhost bin]# ./splunk cmd /local/dl/setuptools-0.6c11-py2.6.egg Traceback (most recent call last): File "", line 1, in File "/local/dl/setuptools-0.6c11-py2.6.egg/setuptools/init.py", line 2, in File "/local/dl/setuptools-0.6c11-py2.6.egg/setuptools/extension.py", line 2, in File "/local/dl/setuptools-0.6c11-py2.6.egg/setuptools/dist.py", line 5, in File "/local/dl/setuptools-0.6c11-py2.6.egg/setuptools/command/init.py", line 13, in ImportError: No module named command.bdist

[root@localhost bin]# ./splunk cmd /local/dl/MySQL_python-1.2.3c1-py2.6-linux-i686.egg couldn't run "/local/dl/MySQL_python-1.2.3c1-py2.6-linux-i686.egg": Exec format error

@the_wolverine, how to tell splunk to execute lookup python script with system's Python?

Thanks,

Dianbo

Just use the standard way of installing modules (make sure that splunk and python are in path):
Untar pymssql-1.0.2.tar.gz
cd pymssql-1.0.2
splunk cmd python setup.py install