How do you change the time period of a saved search when running from the CLI?
Right now I have a saved search that runs over a 30min window by default. I normally will run it like this:
/opt/splunk/bin/splunk search "|savedsearch \"Top HTTP Response Codes\""
Assuming I want to run that same saved search over a 1h window what can I do? I tried this but it did not seem to work:
/opt/splunk/bin/splunk search "|savedsearch \"Top HTTP Response Codes\"" -earliest_time "−50m"
I don't get any errors but it ran it over the same timeframe as before.