Reporting

running a Saved Search from the Command Line Interface (CLI)

seanlon11
Path Finder

How do I run a Saved Search from the CLI whose name has spaces in it?

When I run a Saved Search whose name does NOT have spaces it works fine:

  • ./splunk search "| savedsearch wpsqa01_login_scconlo"

When I try to run the following Saved Search WITH spaces, I receive an error:

  • ./splunk search "| savedsearch Application Login Attempts"
  • Error in 'savedsearch' command: Unable to find saved search named 'Application'.

I have tried multiple combinations of single and double quotes, but so far I cannot get it to work.

Any suggestions on how to get my Saved Search that has spaces in its name to work from the CLI?

Thanks, Sean

Tags (2)
1 Solution

bwooden
Splunk Employee
Splunk Employee

A double quoted search name within a single quoted search command worked for me...

$SPLUNK_HOME/bin/splunk search '|savedsearch "Splunk errors last 24 hours"'

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You should open up a new topic on quoting CLI commands in Windows. But basically, because the Windows CMD shell has strange rules. You should quote the search string with double quotes ", but if you have to use double quotes within the search string to quote the name of a saved search, you probably need to quote those in turn by using double double-quotes "" in place of the single ones.

jambajuice
Communicator

I am trying to run a saved search from the command-line in Windows. When I run the search with a "|" character before "savedsearch", Windows says that it doesn't recognize 'savedsearch' as an internal or external command.

How can I run a saved search from the command-line in Windows?

chris
Motivator

If your saved search is in your own custom app you can run it as follows:

$SPLUNK_HOME/bin/splunk search '| savedsearch "My saved search"' -app myAppName

bwooden
Splunk Employee
Splunk Employee

A double quoted search name within a single quoted search command worked for me...

$SPLUNK_HOME/bin/splunk search '|savedsearch "Splunk errors last 24 hours"'

seanlon11
Path Finder

Worked like a charm. Thought I had tried that combination, but apparently I was mistaken.

Thanks.

vishaltaneja070
Motivator

@bwooden Not working in Windows CLI.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...