SPLUNK-CLIENT(1)

💖 SPLUNK-CLIENT — the sc girlies' guide 💖

okay so this is SPLUNK-CLIENT(1), aka the manual page for sc, aka the Splunk Client, bestie. pull up a chair, grab a boba, we're doing this. 🧋✨

---

✨ NAME ✨

sc — Splunk Client. that's it, that's the name, short and iconic. 👑

---

🦋 SYNOPSIS 🦋

sc [--host <host>] [--port <port>] [--login <login>] [--password <password>] [--insecure] <subcommand> [<arguments>,...]

---

🌸 DESCRIPTION 🌸

so basically this is a remote client for the Splunk log search engine, built on top of WWW::Splunk. 💅

ngl, right now it is quite limited in capabilities — like, it's giving baby project, it's giving first draft — BUT the whole point is that it's intended and designed to be extended in future. it's a grower, not a show-er. the potential is there, the main character arc is coming, periodt. 🌱🔥

---

🎀 OPTIONS 🎀

• --host <host> — sets the remote server you're connecting to. defaults to localhost, so if you say nothing it's just gonna assume you mean your own lil machine. 🏠
• --port <port> — sets the port of the remote server to connect to. defaults to 8089. ⚠️ and listen, this is the management port, not the WWW interface port — do not mix those up, bestie, it will not go well, iykyk. 😭
• --login <login> — the user name of the user you're connecting to Splunk as. defaults to admin. and like… the defaults for username and password will probably (hopefully?) not suit your configuration. so maybe don't rawdog the defaults, yeah? 🙈
• --password <password> — the password of the user you're connecting to Splunk as. defaults to changeme. and again: probably not your actual vibe. 💀
• --insecure — tolerate SSL errors. that's it, that's the whole flag. living dangerously, love that for you. 🫣
• <subcommand> [<arguments>] — the subcommand to run. currently the only one defined is search. one subcommand, but she's doing her best. 🫶

---

🔥 COMMANDS 🔥

🌈 search

search [-t|--since <time>] [-T|--until <time>] [-f|--format compact|long|raw] <search string>

conducts a search, and outputs the raw log data as they are looked up. 👀 it terminates when the search is finished — so it just… keeps streaming at you until it's done. no cap.

• -t, --since <time> — cut off at the given time. the time specification is any string understood by Date::Manip. most common formats apply, plus human-readable relative time specifications (peep the EXAMPLES section for the tea). ☕

use "rt" for a real time search, optionally with specifcation of the search window, like "rt-10" for a 10-second window, or "rt-1m" for one minute. ✨

defaults to unlimited — the whole timeline, the entire lore, everything. 🌌

• -T, --until <time> — do not look for entries newer than the given time. the format of the time specification is exactly the same as for the --since option, twinsies. 👯

if this or --since is "rt" a real-time search is conducted. 🕐

• -f, --format compact|long|raw — switch output format style. pick your aesthetic. 💅

---

🍓 ENVIRONMENT VARIABLES 🍓

• SPLUNK_LOGIN — Splunk login. 🔑
• SPLUNK_PASSWORD — Splunk password. 🤫

---

💜 EXAMPLES 💜

1. perform a simple search query limited by given time frame. ⏳

sc --host splunk.example.net --login user --password s1kr3t2 search --since '2 days ago' --until yesterday 'network AND error | head 10'

2. perform a simple real-time search. ⚡

sc search --since 'rt-30' 'source=/var/log/httpd/access_log |stats count by http_status_code'

---

👑 SEE ALSO 👑

WWW::Splunk, WWW::Splunk::API — go read those too, they're the whole support system. 🫶

---

🌟 AUTHORS 🌟

Lubomir Rintel, <lkundrak@v3.sk>, Michal Josef Špaček <skim@cpan.org>

the code is hosted on GitHub at <http://github.com/michal-josef-spacek/perl-WWW-Splunk>. 🐙

bug fixes and feature enhancements are always welcome — so if you've got a glow-up in mind, send it in, bestie, they want it fr fr. 💌

---

and that's the whole page, no notes, you're officially a Splunk girlie now 💖✨

this was SPLUNK-CLIENT(1), brought to you by perl v5.42.0 and dated 2025-07-25 — mwah, slay, bye bestie! 💅🎀🦋