Splunk Search

Command Line Search with Time Frame

jkfierro
Explorer

I am running version 4.1.2.

I am trying to complete a search of a source using the command line tools. I need to specify a time frame as well, perhaps "the last fifteen minutes" for example. I am able to do this within the GUI using some of the time functions, but none of those work in command line.

Any ideas?

gfriedmann
Communicator

I found this question because it appeared that my CLI search was not returning events beyond the current day. I first thought it was because i didn't specify a time range.

I discovered that the CLI search is limited by 100 results by default. This can be changed with the argument -maxout 0 for all results.

Example: ./splunk search 'gfriedmann earliest=-7d' -maxout 200

You may also use -maxout 0 for unlimited.

Be careful, though. I think CLI searches won't timeout, so it may keep chugging for a LONG time if you dont' limit it properly.

More info: http://www.splunk.com/base/Documentation/latest/SearchReference/CLIsearchsyntax

gkanapathy
Splunk Employee
Splunk Employee

You can just add the parameters "earliest=" and/or "latest=" to your search terms, e.g:

sourcetype=xx "search 1" "term2" earliest=-15m | stats count 

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relat...

gkanapathy
Splunk Employee
Splunk Employee

The search string must be passed as a single argument on the command line. Generally the easiest way to do this in the shell is to quote the entire search string within single quotes.

0 Karma

jkfierro
Explorer

I understand this. This works in the GUI. But not as a command.

Right now, my command is 'splunk search source="/var/log/secure" "invalid user"'

This works, but retrieves all events. I want to retrieve events from only the last fifteen minutes.

If I try 'splunk search source="/var/log/secure" earliest=-15m "invalid user"' it will still retrieve all events.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...