Splunk search API client

splunk.rb

require 'httparty'

class Splunk
  include HTTParty
  base_uri 'https://YOUR_SPLUNK_SERVER:8089/services'

  def initialize(username, password)
    @auth = { :username => username, :password => password }
  end

  def search(query, options = {})
    options[:earliest_time] ||= '-15m'
    [:earliest_time, :latest_time, :time].each { |t| options[t] = format_time(options[t]) if options[t] }
    body = { :search => "search #{query}", :exec_mode => 'oneshot', :output_mode => 'csv', :count => 0 }.merge(options)

    response = self.class.post '/search/jobs', :body => body, :basic_auth => @auth

    raise SearchError, response['response']['messages']['msg'] if response.code != 200

    response.parsed_response
  end

  private

  def format_time(time)
    time.is_a?(Time) ? time.strftime('%Y-%m-%dT%H:%M:%S%z') : time.to_s
  end

  class SearchError < StandardError; end
end

The streaming (non-blocking) endpoint might be of interest to you as well... Here's an example https://github.com/docyes/splunk_blaze/blob/master/splunkblaze/backlog/rt.py (Python)