I am running version 4.1.2.
I am trying to complete a search of a source using the command line tools. I need to specify a time frame as well, perhaps "the last fifteen minutes" for example. I am able to do this within the GUI using some of the time functions, but none of those work in command line.
Any ideas?
I found this question because it appeared that my CLI search was not returning events beyond the current day. I first thought it was because i didn't specify a time range.
I discovered that the CLI search is limited by 100 results by default. This can be changed with the argument -maxout 0 for all results.
Example: ./splunk search 'gfriedmann earliest=-7d' -maxout 200
You may also use -maxout 0 for unlimited.
Be careful, though. I think CLI searches won't timeout, so it may keep chugging for a LONG time if you dont' limit it properly.
More info: http://www.splunk.com/base/Documentation/latest/SearchReference/CLIsearchsyntax
You can just add the parameters "earliest=" and/or "latest=" to your search terms, e.g:
sourcetype=xx "search 1" "term2" earliest=-15m | stats count
The search string must be passed as a single argument on the command line. Generally the easiest way to do this in the shell is to quote the entire search string within single quotes.
I understand this. This works in the GUI. But not as a command.
Right now, my command is 'splunk search source="/var/log/secure" "invalid user"'
This works, but retrieves all events. I want to retrieve events from only the last fifteen minutes.
If I try 'splunk search source="/var/log/secure" earliest=-15m "invalid user"' it will still retrieve all events.