Command Line Search with Time Frame

[jkfierro]

I am running version 4.1.2.

I am trying to complete a search of a source using the command line tools. I need to specify a time frame as well, perhaps "the last fifteen minutes" for example. I am able to do this within the GUI using some of the time functions, but none of those work in command line.

Any ideas?

[gfriedmann]

I found this question because it appeared that my CLI search was not returning events beyond the current day. I first thought it was because i didn't specify a time range.

I discovered that the CLI search is limited by 100 results by default. This can be changed with the argument -maxout 0 for all results.

Example: ./splunk search 'gfriedmann earliest=-7d' -maxout 200

You may also use -maxout 0 for unlimited.

Be careful, though. I think CLI searches won't timeout, so it may keep chugging for a LONG time if you dont' limit it properly.

More info: http://www.splunk.com/base/Documentation/latest/SearchReference/CLIsearchsyntax

[gkanapathy]

You can just add the parameters "earliest=" and/or "latest=" to your search terms, e.g:

sourcetype=xx "search 1" "term2" earliest=-15m | stats count 

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relat...

[gkanapathy]

The search string must be passed as a single argument on the command line. Generally the easiest way to do this in the shell is to quote the entire search string within single quotes.

[jkfierro]

I understand this. This works in the GUI. But not as a command.

Right now, my command is 'splunk search source="/var/log/secure" "invalid user"'

This works, but retrieves all events. I want to retrieve events from only the last fifteen minutes.

If I try 'splunk search source="/var/log/secure" earliest=-15m "invalid user"' it will still retrieve all events.