https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17108#M2340 <P>I understand this. This works in the GUI. But not as a command.</P> <P>Right now, my command is 'splunk search source="/var/log/secure" "invalid user"'</P> <P>This works, but retrieves all events. I want to retrieve events from only the last fifteen minutes.</P> <P>If I try 'splunk search source="/var/log/secure" earliest=-15m "invalid user"' it will still retrieve all events.</P> Fri, 09 Jul 2010 22:15:00 GMT jkfierro 2010-07-09T22:15:00Z https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17106#M2338 <P>I am running version 4.1.2.</P> <P>I am trying to complete a search of a source using the command line tools. I need to specify a time frame as well, perhaps "the last fifteen minutes" for example. I am able to do this within the GUI using some of the time functions, but none of those work in command line.</P> <P>Any ideas?</P> Fri, 09 Jul 2010 21:55:43 GMT https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17106#M2338 jkfierro 2010-07-09T21:55:43Z https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17107#M2339 <P>You can just add the parameters "earliest=" and/or "latest=" to your search terms, e.g:</P> <PRE><CODE>sourcetype=xx "search 1" "term2" earliest=-15m | stats count </CODE></PRE> <P><A href="http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relative_time_modifiers" rel="nofollow">http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relative_time_modifiers</A></P> Fri, 09 Jul 2010 22:04:01 GMT https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17107#M2339 gkanapathy 2010-07-09T22:04:01Z https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17108#M2340 <P>I understand this. This works in the GUI. But not as a command.</P> <P>Right now, my command is 'splunk search source="/var/log/secure" "invalid user"'</P> <P>This works, but retrieves all events. I want to retrieve events from only the last fifteen minutes.</P> <P>If I try 'splunk search source="/var/log/secure" earliest=-15m "invalid user"' it will still retrieve all events.</P> Fri, 09 Jul 2010 22:15:00 GMT https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17108#M2340 jkfierro 2010-07-09T22:15:00Z https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17109#M2341 <P>The search string must be passed as a single argument on the command line. Generally the easiest way to do this in the shell is to quote the entire search string within single quotes.</P> Sat, 10 Jul 2010 04:09:30 GMT https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17109#M2341 gkanapathy 2010-07-10T04:09:30Z https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17110#M2342 <P>I found this question because it appeared that my CLI search was not returning events beyond the current day. I first thought it was because i didn't specify a time range. </P> <P>I discovered that the CLI search is limited by 100 results by default. This can be changed with the argument -maxout 0 for all results. </P> <P>Example: ./splunk search 'gfriedmann earliest=-7d' -maxout 200</P> <P>You may also use -maxout 0 for unlimited. </P> <P>Be careful, though. I think CLI searches won't timeout, so it may keep chugging for a LONG time if you dont' limit it properly. </P> <P>More info: <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/CLIsearchsyntax" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/CLIsearchsyntax</A></P> Tue, 23 Nov 2010 04:38:55 GMT https://community.splunk.com/t5/Splunk-Search/Command-Line-Search-with-Time-Frame/m-p/17110#M2342 gfriedmann 2010-11-23T04:38:55Z