How do i perform a UI search via the CLI

[Chris_R_]

How do i use the same search strings in splunks UI on the command line?

[Chris_R_ · Accepted solution]

You can run any long running splunk search via the CLI by navigating to $SPLUNK_HOME/bin And run any search

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00"

If the values get too big you can export your results to a .csv file

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00" | outputcsv myfile.csv'

Search results are stored in $SPLUNK_HOME/var/run/splunk/myfile.csv

[jrodman]

There are some discrepencies between the UI seach behavior and the command line behavior.

The command line defaults to 100 events maximum, for example, because looking at 10,000 events spewing across your terminal isn't very useful.

The UI also has an out-of-band time indicator/chooser, so you are often applying a time selection without considering it, while from the command line, you must explicitly include these terms as part of the search.

There are some other subtler differences which typically will only matter when you are trying to do performance analysis.

[V_at_Splunk]

If quoting on Windows is too hard, put the search into a savedsearches.conf, and then ./splunk search "| savedsearch nameOfMySearch"

[gkanapathy]

You do need to be aware of quoting rules depending on the shell you are using. For most Unix shells, you can surround with single quotes, and if your search string contains single quotes, you can escape those with a preceding backslash. The rules for Windows cmd.exe and PowerShell are rather more esoteric, but most of the time, you can surround the string with double quotes, even if the search string contains double quotes. Most of the time.