Troubleshooting the Splunk SDK for PHP

The Splunk SDK for PHP is deprecated. For more information, see Deprecation notice.

This topic describes how to troubleshoot problems when coding with the Splunk® SDK for PHP. It contains the following sections:

If you still have questions after reading this topic, see the Questions? sidebar on the right side of this page for additional help.

 

Splunk PHP app returning <sg> tags in the middle of the _raw field

Apps created with the Splunk SDK for PHP have segmentation turned on unless you explicitly turn it off. When segmentation is turned on, the SDK will return <sg> tags in the middle of the _raw field's value. In Splunk Web, <sg> tags denote where color highlighting should be applied. Since it's your app that is consuming the search results and not Splunk Web, it is safe to turn segmentation off. To do this, you can add the segmentation key to your custom arguments. For instance, to turn segmentation off for a oneshot search:

...
$searchParams = array(
    'earliest_time' => '2012-06-19T12:00:00.000-07:00',    
    'latest_time' => '2013-12-02T12:00:00.000-07:00',
    'segmentation' => 'off'
);
 
$resultsStream = $service->oneshotSearch($searchQueryOneshot, $searchParams);
 

Splunk PHP app cannot access Splunk over HTTPS

To access Splunk over https:// URLs, you must compile PHP with OpenSSL support.

 

SDK is not functioning at all when using a supported version of PHP that is older than 5.3.7

If you're using PHP 5.3.6 or earlier, the cURL extension is required. Also, be aware that, under this configuration, the SDK does not support streaming large result sets when accessing Splunk.