Splunk Search

What is the proper syntax to pass time parameters in a search via CLI?

darlas
Communicator

I am trying to run the search command at the CLI, passing a time range. I've studied all the docs and answers I can find on how to pass time parameters, but none seem to work. Either no results come back or results for all time come back.

What is the proper syntax for passing time parameters?

Here are a few permutations I have tried with no success.

splunk search 'index=pan_logs log_subtype=url user="donald.duck" -earlist_time=”9/20/2015:00:00:00”  -latest_time=”9/21/2015:00:00:00”’
splunk search 'index=pan_logs log_subtype=url user="donald.duck" -earlist=”9/20/2015:00:00:00”  -latest=”9/21/2015:00:00:00”’
splunk search 'index=pan_logs log_subtype=url user="donald.duck"’ –index_earliest ‘1442646000’  -index_latest ‘1442818800 ‘
splunk search 'index=pan_logs log_subtype=url user="donald.duck" -earlist_time ”9/20/2015:00:00:00”  -latest_time ”9/21/2015:00:00:00”’
splunk search 'index=pan_logs log_subtype=url user="donald.duck"’ –index_earliest=‘1442646000’  -index_latest=‘1442818800 ‘

What am I doing wrongs?????

Thanks!

Tags (3)
0 Karma

masonmorales
Influencer

You have a typo in earliest:

-earlist_time=”9/20/2015:00:00:00”

And you should be able to specify the time range as part of the search:

splunk search 'index=pan_logs user="donald.duck" earliest=09/20/2015:00:00:00 latest=09/21/2015:00:00:00'
0 Karma

masonmorales
Influencer
0 Karma

darlas
Communicator

Hi! Thanks for the quick response! Unfortunately, your syntax did not work either. I read the document you reference as well as a number of posts on answers; there are a number of formats shown between these sources but none seem to work.

I don't get an error with your syntax but I do not get any events. And I know there are events for my search in the time period specified.

Any other thoughts?

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...