I've been trying variations of this:
/opt/splunk/bin/splunk search "10.3.16.31" -latest_time '-4h@h'
but it doesn't limit things -- i get everything going back to
year zero. what am i doing wrong?
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CLIsearchsyntax
is where i saw -latest_time.
i am a newbie at the CLI.
w/ apostrophes as you show them, i get no output at all.
w/ quotes instead of apostrophes, i get no output.
w/ nothing i get no limits -- everything since time 0.
Where did you find "-latest_time" - I don't see that it is a valid term. Also, if it worked, it would specify the ending time, not the beginning time - so the search would start at the beginning of time and end 4 hours ago. I don't think that is what you want.
I would do it like this
/opt/splunk/bin/splunk search "10.3.16.31 earliest=-4h@h"
or
/opt/splunk/bin/splunk search "10.3.16.31" -earliest_time '-4h@h'