Splunk Search

Command Line Search with Time Frame

jkfierro
Explorer

I am running version 4.1.2.

I am trying to complete a search of a source using the command line tools. I need to specify a time frame as well, perhaps "the last fifteen minutes" for example. I am able to do this within the GUI using some of the time functions, but none of those work in command line.

Any ideas?

gfriedmann
Communicator

I found this question because it appeared that my CLI search was not returning events beyond the current day. I first thought it was because i didn't specify a time range.

I discovered that the CLI search is limited by 100 results by default. This can be changed with the argument -maxout 0 for all results.

Example: ./splunk search 'gfriedmann earliest=-7d' -maxout 200

You may also use -maxout 0 for unlimited.

Be careful, though. I think CLI searches won't timeout, so it may keep chugging for a LONG time if you dont' limit it properly.

More info: http://www.splunk.com/base/Documentation/latest/SearchReference/CLIsearchsyntax

gkanapathy
Splunk Employee
Splunk Employee

You can just add the parameters "earliest=" and/or "latest=" to your search terms, e.g:

sourcetype=xx "search 1" "term2" earliest=-15m | stats count 

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relat...

gkanapathy
Splunk Employee
Splunk Employee

The search string must be passed as a single argument on the command line. Generally the easiest way to do this in the shell is to quote the entire search string within single quotes.

0 Karma

jkfierro
Explorer

I understand this. This works in the GUI. But not as a command.

Right now, my command is 'splunk search source="/var/log/secure" "invalid user"'

This works, but retrieves all events. I want to retrieve events from only the last fifteen minutes.

If I try 'splunk search source="/var/log/secure" earliest=-15m "invalid user"' it will still retrieve all events.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...