Splunk Search

How do i perform a UI search via the CLI

Chris_R_
Splunk Employee
Splunk Employee

How do i use the same search strings in splunks UI on the command line?

Tags (3)
0 Karma
1 Solution

Chris_R_
Splunk Employee
Splunk Employee

You can run any long running splunk search via the CLI by navigating to $SPLUNK_HOME/bin And run any search

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00"

If the values get too big you can export your results to a .csv file

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00" | outputcsv myfile.csv'

Search results are stored in $SPLUNK_HOME/var/run/splunk/myfile.csv

View solution in original post

Chris_R_
Splunk Employee
Splunk Employee

You can run any long running splunk search via the CLI by navigating to $SPLUNK_HOME/bin And run any search

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00"

If the values get too big you can export your results to a .csv file

./splunk dispatch 'host="mybox" starttime="01/25/2010:09:00:00" endtime="01/25/2010:09:59:00" | outputcsv myfile.csv'

Search results are stored in $SPLUNK_HOME/var/run/splunk/myfile.csv

jrodman
Splunk Employee
Splunk Employee

There are some discrepencies between the UI seach behavior and the command line behavior.

The command line defaults to 100 events maximum, for example, because looking at 10,000 events spewing across your terminal isn't very useful.

The UI also has an out-of-band time indicator/chooser, so you are often applying a time selection without considering it, while from the command line, you must explicitly include these terms as part of the search.

There are some other subtler differences which typically will only matter when you are trying to do performance analysis.

0 Karma

V_at_Splunk
Splunk Employee
Splunk Employee

If quoting on Windows is too hard, put the search into a savedsearches.conf, and then ./splunk search "| savedsearch nameOfMySearch"

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You do need to be aware of quoting rules depending on the shell you are using. For most Unix shells, you can surround with single quotes, and if your search string contains single quotes, you can escape those with a preceding backslash. The rules for Windows cmd.exe and PowerShell are rather more esoteric, but most of the time, you can surround the string with double quotes, even if the search string contains double quotes. Most of the time.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...