WWW::Splunk(3pm)

🌸 NAME 🌸

okay so bestie, meet WWW::Splunk — a client library for the Splunk log search engine. yes, the big log-search one. this is her manual page, WWW::Splunk(3pm), filed under User Contributed Perl Documentation, and she's here to make your Splunk API life cute and functional 💅

---

✨ SYNOPSIS ✨

the whole vibe in one little code block, no notes:

use WWW::Splunk;

my $splunk = WWW::Splunk->new({
        host => $host,
        port => $port,
        login => $login,
        password => $password,
        unsafe_ssl => 1,
        verbose => 0,
});

my $sid = $splunk->start_search('selinux avc');
$splunk->poll_search($sid);
until ($splunk->results_read($sid)) {
        print scalar $splunk->search_results($sid);
}
print " results found\n";

like… build the object, kick off a search, wait for it, dump results until there's nothing left, print the count. that's it. that's the whole main character arc. 🦋

---

💜 DESCRIPTION 💜

this module is a little bundle of utility functions for the Splunk API. she implements the version 4.1 API, and she's been verified to work with the 4.2, 4.3 and 5.0.3 versions too. so she's giving range, she's giving longevity, she's giving iykyk. 🌈

🔍 start_search (string) [(since)] [(until)]

kick off a search and get back a SID (that's a Search ID) string. it's giving "go bestie go". 🎀

🔥 rt_search (string) (callback) [(since)] [(until)]

start a real-time search, and she'll call your callback for every single line matched. every one. no cap.

heads up though — this one only finishes if the connection terminates, which means… potentially never 😭 and when it does wrap up, it returns the number of results consumed.

✅ search_done (sid)

returns true if the search is finished. simple. iconic. periodt.

⏳ poll_search (sid)

just sits there and waits for a search to finish. the patient bestie of the group chat. 🫶

📦 search_results (sid)

returns an array of the matched events. here's the tea though — if you call it multiple times, it only gives you the events that were added from the time of the last call. so don't be shocked when it's not the whole thing every time, she's incremental like that. 💅

oh, and also: you can't run multiple searches concurrently with a single WWW::Splunk instance. otherwise, WWW::Splunk is perfectly thread-safe. noted, bestie. 📝

🏁 results_read (sid)

returns true if the search is finished <em>and</em> there are no more results to read — meaning everything got fetched already with search_results. the "we're so done here" check. 💀

---

👑 AUTHORS 👑

the legends behind this:

• Lubomir Rintel, <lkundrak@v3.sk>
• Michal Josef Špaček <skim@cpan.org>

the code is hosted on GitHub at http://github.com/michal-josef-spacek/perl-WWW-Splunk. bug fixes and feature enhancements are always welcome — so if you're feeling generous with your brain, slide in. 🙈

---

📜 LICENSE 📜

this is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. slay, legally. ⭐

---

💸 DONATIONS 💸

if you use this library and find it useful, donations are greatly appreciated! support the devs, they ate. 🍓

---

and that's the whole page, bestie — this was WWW::Splunk(3pm), generated with perl v5.42.0 on 2025-07-25. go forth and search your logs. no cap, fr fr. 💖✨