AppInspect reports failure with splunk-sdk: Some 'search/*' endpoints has been deprecated in Splunk 9.0.1

AppInspect reports failure with splunk-sdk: Some 'search/*' endpoints has been deprecated in Splunk 9.0.1

Vendored the Splunk Python SDK into a Splunk app and ran splunk-appinspect, which fails with: "FAILURE: Some 'search/*' endpoints has been deprecated in Splunk 9.0.1 and replaced by new v2 APIs", pointing at lib/splunklib/client.py line 578. Same failure showed up with splunk-sdk 1.7.4 and 2.0.2. The vendored copy of splunklib in the app had been hand-edited (imports changed from from splunklib import to relative from . import, trailing newlines added), so it no longer matched the SDK files AppInspect allowlists. AppInspect only skips the check when the vendored files are byte-identical to the SDK on GitHub.

How to handle it

The check is AppInspect's, not the SDK's, and it passes only for pristine SDK files. Diff your vendored splunklib against the SDK source on GitHub (e.g. git diff on the vendored client.py), then replace the whole splunklib directory with an exact copy from the SDK repo and make sure imports say from splunklib import ... rather than relative imports. Two separate reporters confirmed the failure disappeared once their vendored copy was byte-identical to the one on GitHub, and closed their issues and support tickets on that resolution.

Source: https://github.com/splunk/splunk-sdk-python/issues/594

Question asked in the thread: Vendored the Splunk Python SDK into a Splunk app and ran splunk-appinspect, which fails with: "FAILURE: Some 'search/*' endpoints has been deprecated in Splunk 9.0.1 and replaced by new v2 APIs", pointing at lib/splunklib/client.py line 578. Same failure showed up with splunk-sdk 1.7.4 and 2.0.2. The vendored copy of splunklib in the app had been hand-edited (imports changed from from splunklib import to relative from . import, trailing newlines added), so it no longer matched the SDK files AppInspect allowlists. AppInspect only skips the check when the vendored files are byte-identical to the SDK on GitHub.

Verified answer: The check is AppInspect's, not the SDK's, and it passes only for pristine SDK files. Diff your vendored splunklib against the SDK source on GitHub (e.g. git diff on the vendored client.py), then replace the whole splunklib directory with an exact copy from the SDK repo and make sure imports say from splunklib import ... rather than relative imports. Two separate reporters confirmed the failure disappeared once their vendored copy was byte-identical to the one on GitHub, and closed their issues and support tickets on that resolution.

Source: https://github.com/splunk/splunk-sdk-python/issues/594

Thread: https://vectle.com/threads/thr_fcq4xbNxmznrWK3sA4G4CQ