https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65430#M16249 <P>Perfect. Thanks!!</P> Mon, 29 Aug 2011 14:23:32 GMT DTERM 2011-08-29T14:23:32Z https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65428#M16247 <P>I'm getting error an on piping one command into another. The result is a "Search operation 'earliest' is unknown. You might not have permission to run this operation." </P> <P>Both commands work individually, not sure why I can't pipe the output of one into the other. I'd like to know why this fails if you don't find.</P> <P><STRONG>First Query</STRONG></P> <P>index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence</P> <P><STRONG>Second Query</STRONG></P> <P>index=myapp earliest=-30d@d-14h | eval Shift=if(10&lt;=date_hour and date_hour&lt;22,"Shift1","Shift2") | timechart span=1d count by Shift</P> <P><STRONG>Combined Query</STRONG></P> <P>index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence | earliest=-30d@d-14h | eval Shift=if(10&lt;=date_hour and date_hour&lt;22,"Shift1","Shift2") | timechart span=1d count by Shift</P> Mon, 28 Sep 2020 09:50:27 GMT https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65428#M16247 DTERM 2020-09-28T09:50:27Z https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65429#M16248 <P>earliest is not a command you can pipe to. It must be part of your base search.</P> Fri, 26 Aug 2011 21:15:17 GMT https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65429#M16248 rroberts 2011-08-26T21:15:17Z https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65430#M16249 <P>Perfect. Thanks!!</P> Mon, 29 Aug 2011 14:23:32 GMT https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65430#M16249 DTERM 2011-08-29T14:23:32Z https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65431#M16250 <P>Perhaps you can accept the answer?</P> Wed, 31 Aug 2011 21:54:21 GMT https://community.splunk.com/t5/Splunk-Search/error-piping-commands/m-p/65431#M16250 melting 2011-08-31T21:54:21Z