Refine your search:

How do you change the time period of a saved search when running from the CLI?

Right now I have a saved search that runs over a 30min window by default. I normally will run it like this:

/opt/splunk/bin/splunk search  "|savedsearch \"Top HTTP Response Codes\""

Assuming I want to run that same saved search over a 1h window what can I do? I tried this but it did not seem to work:

/opt/splunk/bin/splunk search  "|savedsearch \"Top HTTP Response Codes\"" -earliest_time "−50m" 

I don't get any errors but it ran it over the same timeframe as before.

asked 19 Aug '10, 20:40

zscgeek's gravatar image

zscgeek
288110
accept rate: 35%

edited 20 Aug '10, 16:14

Stephen%20Sorkin's gravatar image

Stephen Sorkin ♦
8.1k47


2 Answers:

currently there is no way to override the time range over which the savedsearch is executed when ran from the CLI. Unfortunately there currently is no workaround for this issue.

I have filed a bug, SPL-33374, which should be fixed in one of the next maintenance releases.

link

answered 20 Aug '10, 16:24

Ledion%20Bitincka's gravatar image

Ledion Bitincka ♦
1.5k36
accept rate: 35%

Is this still the case ?? can you still not use a defined time frame on a saved search ?

link

answered 12 Oct '11, 23:40

SeanWilliams's gravatar image

SeanWilliams
1
accept rate: 0%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×200
×196
×82

Asked: 19 Aug '10, 20:40

Seen: 986 times

Last updated: 12 Oct '11, 23:41

Copyright © 2005-2012 Splunk, Inc. All rights reserved.