Splunk Search

CLI ignoring my time limit

glsplunk
New Member

I've been trying variations of this:

/opt/splunk/bin/splunk search "10.3.16.31" -latest_time '-4h@h'

but it doesn't limit things -- i get everything going back to
year zero. what am i doing wrong?

Tags (1)
0 Karma

glsplunk
New Member

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CLIsearchsyntax
is where i saw -latest_time.

i am a newbie at the CLI.

w/ apostrophes as you show them, i get no output at all.

w/ quotes instead of apostrophes, i get no output.

w/ nothing i get no limits -- everything since time 0.

0 Karma

lguinn2
Legend

Where did you find "-latest_time" - I don't see that it is a valid term. Also, if it worked, it would specify the ending time, not the beginning time - so the search would start at the beginning of time and end 4 hours ago. I don't think that is what you want.

I would do it like this

/opt/splunk/bin/splunk search "10.3.16.31 earliest=-4h@h"

or

/opt/splunk/bin/splunk search "10.3.16.31" -earliest_time '-4h@h'
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...