Splunk Search

How do i perform a UI search via the CLI

Chris_R_
Splunk Employee
Splunk Employee

How do i use the same search strings in splunks UI on the command line?

Tags (3)
0 Karma
1 Solution

Chris_R_
Splunk Employee
Splunk Employee

You can run any long running splunk search via the CLI by navigating to $SPLUNK_HOME/bin And run any search

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00"

If the values get too big you can export your results to a .csv file

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00" | outputcsv myfile.csv'

Search results are stored in $SPLUNK_HOME/var/run/splunk/myfile.csv

View solution in original post

Chris_R_
Splunk Employee
Splunk Employee

You can run any long running splunk search via the CLI by navigating to $SPLUNK_HOME/bin And run any search

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00"

If the values get too big you can export your results to a .csv file

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00" | outputcsv myfile.csv'

Search results are stored in $SPLUNK_HOME/var/run/splunk/myfile.csv

jrodman
Splunk Employee
Splunk Employee

There are some discrepencies between the UI seach behavior and the command line behavior.

The command line defaults to 100 events maximum, for example, because looking at 10,000 events spewing across your terminal isn't very useful.

The UI also has an out-of-band time indicator/chooser, so you are often applying a time selection without considering it, while from the command line, you must explicitly include these terms as part of the search.

There are some other subtler differences which typically will only matter when you are trying to do performance analysis.

0 Karma

V_at_Splunk
Splunk Employee
Splunk Employee

If quoting on Windows is too hard, put the search into a savedsearches.conf, and then ./splunk search "| savedsearch nameOfMySearch"

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You do need to be aware of quoting rules depending on the shell you are using. For most Unix shells, you can surround with single quotes, and if your search string contains single quotes, you can escape those with a preceding backslash. The rules for Windows cmd.exe and PowerShell are rather more esoteric, but most of the time, you can surround the string with double quotes, even if the search string contains double quotes. Most of the time.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...