CLI ignoring my time limit

[glsplunk]

I've been trying variations of this:

/opt/splunk/bin/splunk search "10.3.16.31" -latest_time '-4h@h'

but it doesn't limit things -- i get everything going back to
year zero. what am i doing wrong?

[glsplunk]

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CLIsearchsyntax
is where i saw -latest_time.

i am a newbie at the CLI.

w/ apostrophes as you show them, i get no output at all.

w/ quotes instead of apostrophes, i get no output.

w/ nothing i get no limits -- everything since time 0.

[lguinn2]

Where did you find "-latest_time" - I don't see that it is a valid term. Also, if it worked, it would specify the ending time, not the beginning time - so the search would start at the beginning of time and end 4 hours ago. I don't think that is what you want.

I would do it like this

/opt/splunk/bin/splunk search "10.3.16.31 earliest=-4h@h"

or

/opt/splunk/bin/splunk search "10.3.16.31" -earliest_time '-4h@h'