Splunk Search

Command Line Search with Time Frame

Explorer

I am running version 4.1.2.

I am trying to complete a search of a source using the command line tools. I need to specify a time frame as well, perhaps "the last fifteen minutes" for example. I am able to do this within the GUI using some of the time functions, but none of those work in command line.

Any ideas?

Communicator

I found this question because it appeared that my CLI search was not returning events beyond the current day. I first thought it was because i didn't specify a time range.

I discovered that the CLI search is limited by 100 results by default. This can be changed with the argument -maxout 0 for all results.

Example: ./splunk search 'gfriedmann earliest=-7d' -maxout 200

You may also use -maxout 0 for unlimited.

Be careful, though. I think CLI searches won't timeout, so it may keep chugging for a LONG time if you dont' limit it properly.

More info: http://www.splunk.com/base/Documentation/latest/SearchReference/CLIsearchsyntax

Splunk Employee
Splunk Employee

You can just add the parameters "earliest=" and/or "latest=" to your search terms, e.g:

sourcetype=xx "search 1" "term2" earliest=-15m | stats count 

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relat...

Splunk Employee
Splunk Employee

The search string must be passed as a single argument on the command line. Generally the easiest way to do this in the shell is to quote the entire search string within single quotes.

0 Karma

Explorer

I understand this. This works in the GUI. But not as a command.

Right now, my command is 'splunk search source="/var/log/secure" "invalid user"'

This works, but retrieves all events. I want to retrieve events from only the last fifteen minutes.

If I try 'splunk search source="/var/log/secure" earliest=-15m "invalid user"' it will still retrieve all events.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!