splunk · wtobis-splunk · Aug 6, 2025 · Aug 6, 2025 · Mar 10, 2026 · Mar 10, 2026
@@ -10,6 +10,10 @@ on:
   pull_request:
     branches: [main, develop]
 
+env:
+  PYTHON_VERSION: "3.9"
+  POETRY_VERSION: "2.1.2"
+
 jobs:
   meta:
     runs-on: ubuntu-latest
@@ -55,7 +59,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.7"
+          python-version: ${{ env.PYTHON_VERSION }}
       - uses: pre-commit/[email protected]
 
   semgrep:
@@ -71,8 +75,6 @@ jobs:
     strategy:
       matrix:
         python-version:
-          - "3.7"
-          - "3.8"
           - "3.9"
           - "3.10"
           - "3.11"
@@ -83,7 +85,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-      - run: curl -sSL https://install.python-poetry.org | python3 - --version 1.5.1
+      - run: curl -sSL https://install.python-poetry.org | python3 - --version ${{ env.POETRY_VERSION }}
       - run: |
           poetry install
           poetry run pytest tests/unit
@@ -100,8 +102,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: 3.7
-      - run: curl -sSL https://install.python-poetry.org | python3 - --version 1.5.1
+          python-version: ${{ env.PYTHON_VERSION }}
+      - run: curl -sSL https://install.python-poetry.org | python3 - --version ${{ env.POETRY_VERSION }}
       - name: Install Splunk
         run: |
           export SPLUNK_PRODUCT=splunk
@@ -135,7 +137,7 @@ jobs:
           echo -e "[user_info]\nUSERNAME=Admin\nPASSWORD=Chang3d"'!' | tee -a $SPLUNK_HOME/etc/system/local/user-seed.conf
           echo 'OPTIMISTIC_ABOUT_FILE_LOCKING=1' | tee -a $SPLUNK_HOME/etc/splunk-launch.conf
           $SPLUNK_HOME/bin/splunk start --accept-license
-          $SPLUNK_HOME/bin/splunk cmd python -m pip install solnlib
+          $SPLUNK_HOME/bin/splunk cmd python -m pip install .
           $SPLUNK_HOME/bin/splunk set servername custom-servername -auth admin:Chang3d!
           $SPLUNK_HOME/bin/splunk restart
           until curl -k -s -u admin:Chang3d! https://localhost:8089/services/server/info\?output_mode\=json | jq '.entry[0].content.kvStoreStatus' | grep -o "ready" ; do echo -n "Waiting for KVStore to become ready-" && sleep 5 ; done
@@ -167,8 +169,8 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.7"
-      - run: curl -sSL https://install.python-poetry.org | python3 - --version 1.5.1
+          python-version: ${{ env.PYTHON_VERSION }}
+      - run: curl -sSL https://install.python-poetry.org | python3 - --version ${{ env.POETRY_VERSION }}
       - run: |
           poetry install
           poetry build

@@ -17,6 +17,7 @@ header:
   license:
     spdx-id: Apache-2.0
     copyright-owner: Splunk Inc.
+    pattern: "Copyright \\d{4} Splunk Inc"
 
   paths-ignore:
     - ".github/"

@@ -3,16 +3,17 @@ repos:
     rev: v3.1.0
     hooks:
     -   id: pyupgrade
-        args: [--py37-plus]
+        args: [--py39-plus]
 -   repo: https://github.com/psf/black
     rev: 22.10.0
     hooks:
     -   id: black
--   repo: https://github.com/myint/docformatter
-    rev: v1.5.0
+-   repo: https://github.com/PyCQA/docformatter
+    rev: v1.7.7
     hooks:
       - id: docformatter
-        args: [--in-place]
+        args: [--in-place, --wrap-summaries, "0", --wrap-descriptions, "0"]
+        language_version: python3
 -   repo: https://github.com/PyCQA/flake8
     rev: 5.0.4
     hooks:

@@ -4,4 +4,4 @@ Splunk Solutions SDK is an open source packaged solution for getting data into S
 This SDK is used by Splunk Add-on builder, and Splunk UCC based add-ons and is intended for use by partner
 developers. This SDK/Library extends the Splunk SDK for Python.
 
-> Note: this project uses `poetry` 1.5.1.
+> Note: this project uses `poetry` 2.1.2.
@@ -0,0 +1,3 @@
+# observability.py
+
+::: solnlib.observability
@@ -0,0 +1,76 @@
+# Release 8.0.0
+
+## Breaking changes
+
+### Python 3.7 and 3.8 are no longer supported
+
+As of version 8.0.0, Python 3.7 and 3.8 are no longer supported.
+The minimum required Python version is now **3.9**.
+
+If your add-on runs on Python 3.7 or 3.8, you must upgrade your environment
+before upgrading solnlib to 8.0.0.
+
+### New required dependencies
+
+The `observability` module introduces the following new dependencies:
+
+* `opentelemetry-api >=1.39.1,<2`
+* `opentelemetry-sdk >=1.39.1,<2`
+* `opentelemetry-exporter-otlp-proto-grpc >=1.39.1,<2`
+* `grpcio >=1.74.0`
+
+These are installed automatically when installing solnlib via pip.
+
+## New features
+
+### ObservabilityService
+
+A new `solnlib.observability` module has been added. It provides OpenTelemetry
+metric instrumentation for Splunk modular inputs, with automatic integration
+with the Splunk Spotlight collector.
+
+The module exposes two public components:
+
+* `ObservabilityService` — initializes a `MeterProvider` with two built-in
+  event counters and attempts to connect to the local Spotlight OTLP collector.
+  Falls back silently when the collector is not available, so observability
+  failures never break the add-on.
+* `LoggerMetricExporter` — an OpenTelemetry `MetricExporter` that writes
+  data points to a Python logger. Useful for local development and debugging.
+
+**Built-in counters:**
+
+| Attribute               | Metric name                   | Unit  |
+|-------------------------|-------------------------------|-------|
+| `event_count_counter`   | `splunk.addon.events`         | `1`   |
+| `event_bytes_counter`   | `splunk.addon.events.bytes`   | `By`  |
+
+**Example usage:**
+
+```python
+import logging
+from solnlib.observability import ObservabilityService, ATTR_MODINPUT_NAME
+
+logger = logging.getLogger(__name__)
+
+obs = ObservabilityService(
+    modinput_type="my-input",
+    logger=logger,
+    ta_name="my_ta",
+    ta_version="1.0.0",
+)
+
+# In your event collection loop:
+if obs.event_count_counter:
+    obs.event_count_counter.add(len(events), {ATTR_MODINPUT_NAME: stanza_name})
+if obs.event_bytes_counter:
+    obs.event_bytes_counter.add(total_bytes, {ATTR_MODINPUT_NAME: stanza_name})
+```
+
+When `ta_name` and `ta_version` are not provided, they are read automatically
+from `app.conf` via `get_conf_stanzas`. Pass them explicitly when running
+outside a full Splunk environment.
+
+Additional instruments can be registered using `ObservabilityService.register_instrument`.
+
+For full API reference see [observability.py](observability.md).
@@ -32,6 +32,7 @@ nav:
   - Home: index.md
   - Release 6.0.0: release_6_0_0.md
   - Release 7.0.0: release_7_0_0.md
+  - Release 8.0.0: release_8_0_0.md
   - References:
       - modular_input:
           - "checkpointer.py": modular_input/checkpointer.md
@@ -45,6 +46,7 @@ nav:
       - "hec_config.py": hec_config.md
       - "log.py": log.md
       - "net_utils.py": net_utils.md
+      - "observability.py": observability.md
       - "orphan_process_monitor.py": orphan_process_monitor.md
       - "pattern.py": pattern.md
       - "server_info.py": server_info.md