custom timeframe on cli with saved searches

[zscgeek]

How do you change the time period of a saved search when running from the CLI?

Right now I have a saved search that runs over a 30min window by default. I normally will run it like this:

/opt/splunk/bin/splunk search  "|savedsearch \"Top HTTP Response Codes\""

Assuming I want to run that same saved search over a 1h window what can I do? I tried this but it did not seem to work:

/opt/splunk/bin/splunk search  "|savedsearch \"Top HTTP Response Codes\"" -earliest_time "−50m" 

I don't get any errors but it ran it over the same timeframe as before.

[Ellen · Accepted solution]

This was fixed since 4.2 under SPL-35277.

Here is a sample CLI that will override the time period existing in a saved search to your custom one (eg. May 6, 2013 7:00am to May 18, 2013 11:00pm) on the Splunk search command line.

$SPLUNK_HOME/bin/splunk search "| savedsearch ChgTime" -auth admin:changeme -earliest_time "2013-05-06T07:00:00.000" -latest_time "2013-05-18T23:00:00.000" -time_format "%FT%T.%Q"

[solarboyz1]

Is this still the case? I can't find any reference to SPL-33374, or any information regarding adjusting the time frame of a saved search.

[SeanWilliams]

Is this still the case ?? can you still not use a defined time frame on a saved search ?

[Ledion_Bitincka]

currently there is no way to override the time range over which the savedsearch is executed when ran from the CLI. Unfortunately there currently is no workaround for this issue.

I have filed a bug, SPL-33374, which should be fixed in one of the next maintenance releases.