How do I run a Saved Search from the CLI whose name has spaces in it?
When I run a Saved Search whose name does NOT have spaces it works fine:
When I try to run the following Saved Search WITH spaces, I receive an error:
I have tried multiple combinations of single and double quotes, but so far I cannot get it to work.
Any suggestions on how to get my Saved Search that has spaces in its name to work from the CLI?
Thanks, Sean
A double quoted search name within a single quoted search command worked for me...
$SPLUNK_HOME/bin/splunk search '|savedsearch "Splunk errors last 24 hours"'
You should open up a new topic on quoting CLI commands in Windows. But basically, because the Windows CMD shell has strange rules. You should quote the search string with double quotes "
, but if you have to use double quotes within the search string to quote the name of a saved search, you probably need to quote those in turn by using double double-quotes ""
in place of the single ones.
I am trying to run a saved search from the command-line in Windows. When I run the search with a "|" character before "savedsearch", Windows says that it doesn't recognize 'savedsearch' as an internal or external command.
How can I run a saved search from the command-line in Windows?
If your saved search is in your own custom app you can run it as follows:
$SPLUNK_HOME/bin/splunk search '| savedsearch "My saved search"' -app myAppName
A double quoted search name within a single quoted search command worked for me...
$SPLUNK_HOME/bin/splunk search '|savedsearch "Splunk errors last 24 hours"'
Worked like a charm. Thought I had tried that combination, but apparently I was mistaken.
Thanks.
@bwooden Not working in Windows CLI.