Splunk Search

How do i perform a UI search via the CLI

Chris_R_
Splunk Employee
Splunk Employee

How do i use the same search strings in splunks UI on the command line?

Tags (3)
0 Karma
1 Solution

Chris_R_
Splunk Employee
Splunk Employee

You can run any long running splunk search via the CLI by navigating to $SPLUNK_HOME/bin And run any search

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00"

If the values get too big you can export your results to a .csv file

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00" | outputcsv myfile.csv'

Search results are stored in $SPLUNK_HOME/var/run/splunk/myfile.csv

View solution in original post

Chris_R_
Splunk Employee
Splunk Employee

You can run any long running splunk search via the CLI by navigating to $SPLUNK_HOME/bin And run any search

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00"

If the values get too big you can export your results to a .csv file

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00" | outputcsv myfile.csv'

Search results are stored in $SPLUNK_HOME/var/run/splunk/myfile.csv

jrodman
Splunk Employee
Splunk Employee

There are some discrepencies between the UI seach behavior and the command line behavior.

The command line defaults to 100 events maximum, for example, because looking at 10,000 events spewing across your terminal isn't very useful.

The UI also has an out-of-band time indicator/chooser, so you are often applying a time selection without considering it, while from the command line, you must explicitly include these terms as part of the search.

There are some other subtler differences which typically will only matter when you are trying to do performance analysis.

0 Karma

V_at_Splunk
Splunk Employee
Splunk Employee

If quoting on Windows is too hard, put the search into a savedsearches.conf, and then ./splunk search "| savedsearch nameOfMySearch"

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You do need to be aware of quoting rules depending on the shell you are using. For most Unix shells, you can surround with single quotes, and if your search string contains single quotes, you can escape those with a preceding backslash. The rules for Windows cmd.exe and PowerShell are rather more esoteric, but most of the time, you can surround the string with double quotes, even if the search string contains double quotes. Most of the time.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...