●Change8

3.0.0

Breaking Changes
📦 splunk-sdkView on GitHub →
⚠ 2 breaking✨ 8 features🐛 16 fixes⚡ 1 deprecations🔧 15 symbols

Summary

This release introduces major new functionality for integrating LLMs with Splunk Apps and includes significant internal modernization, dependency updates, and the removal of legacy components like `ResultsReader`.

⚠️ Breaking Changes

  • Removed `ResultsReader` class, which was likely used for iterating over search results.
  • Removed `six` dependency, indicating removal of Python 2 compatibility code.

Migration Steps

  1. If you were using `ResultsReader`, you must update your result iteration logic.
  2. If you were relying on the `encr_password` field for storage passwords, find its replacement as it is deprecated.

✨ New Features

  • Enabled integration of LLMs with Splunk Apps.
  • Added support for testing macros directly in an SPL query.
  • Documented `key_file`, `cert_file`, `context` parameters.
  • Added support for setting string body in the generic `request` method.
  • Added `patch` and `put` methods to the service object.
  • Support for all ML-KEM key exchange algorithms added.
  • Added `StructuredOutputRetryLimitMiddleware` and default retry limit.
  • Added `thread_id` to middlewares.

🐛 Bug Fixes

  • Ensured `sleep` is always called while restarting.
  • Added space before username in restart required message.
  • Gave Splunk more time after a restart.
  • Resolved warnings emitted by tests.
  • Fixed issue where Host header was specified explicitly (now removed).
  • Added dependencies of test apps into `bin/`.
  • Fixed `test_list_with_sort_dir` test.
  • Fixed `ToolResult.content` type to be `str`.
  • Restricted subagent names.
  • Fixed `splunklib/ai/README.md` content.
  • Fixed MCP Server App download script.
  • Changed `AgentState.response` to `AgentState.messages`.
  • Made `id` required (non-nullable) for tool/subagent/output calls.
  • Explicitly set type in every `LC_ToolCall`.
  • Used keyed parameters in `SubagentTextResult` constructor.
  • Used `thread_ids` in `TimeoutLimitMiddleware`.

Affected Symbols

ResultsReadersixstorage/passwords.encr_passwordModularInput.validate_inputrequestservice.patchservice.putToolResult.contentAgentState.responseAgentState.messagesLC_ToolCallSubagentTextResultthread_idStructuredOutputRetryLimitMiddlewareTimeoutLimitMiddleware

⚡ Deprecations

  • The `encr_password` field from `storage/passwords` is deprecated.