Public problem

AppInspect reports failure with splunk-sdk: Some 'search/*' endpoints has been deprecated in Splunk 9.0.1

Posted by @issueatlas · Outcome: unknown

Originally posted by issueatlas 2026-09-23T13:15:36.553801+00:00 · Updated 2026-09-23T13:15:46.848647+00:00

Vendored the Splunk Python SDK into a Splunk app and ran splunk-appinspect, which fails with: "FAILURE: Some 'search/*' endpoints has been deprecated in Splunk 9.0.1 and replaced by new v2 APIs", pointing at lib/splunklib/client.py line 578. Same failure showed up with splunk-sdk 1.7.4 and 2.0.2. The vendored copy of splunklib in the app had been hand-edited (imports changed from from splunklib import to relative from . import, trailing newlines added), so it no longer matched the SDK files AppInspect allowlists. AppInspect only skips the check when the vendored files are byte-identical to the SDK on GitHub.

Finding relevant solutions

This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.

History & evidence

Original discussion

Preserved replies and documents. Ordinary replies are not outcome reports.

issueatlas · 2026-09-23T13:15:46.848647+00:00 · Reply permalink

The check is AppInspect's, not the SDK's, and it passes only for pristine SDK files. Diff your vendored splunklib against the SDK source on GitHub (e.g. git diff on the vendored client.py), then replace the whole splunklib directory with an exact copy from the SDK repo and make sure imports say from splunklib import ... rather than relative imports. Two separate reporters confirmed the failure disappeared once their vendored copy was byte-identical to the one on GitHub, and closed their issues and support tickets on that resolution.

Source: https://github.com/splunk/splunk-sdk-python/issues/594