Error in 'where' command - how to track down?

[the_wolverine]

I'm seeing the following error in splunkd.log:

ERROR SearchOperator:filter - Error in 'where' command: The operator at 't>0' is invalid.

It occurs regularly so my first guess is a scheduled search that uses the 'where' command. (Am I on track?) I'm only using 'where' in one place currently and its in a conditional search where the condition is " where count>2 "

Is there a bug related to using 'where' as a condition?

[woodcock]

This is a very common cut-and-paste problem and it can be very hard to find. What happens when you cut your search, it had wrapped around the screen to show on more than one line and when you pasted it, it went in like this:

blah blah blah | where coun
t>2

So Splunk is interpreting your search command as

blah blah blah | where coun t>2

Instead of this:

blah blah blah | where count>2

The kicker is that, because where you are viewing your saved search is sized such that the broken and unbroken versions look exactly the same, it is impossible to spot! Now that you know what the problem is, go in and remove the extra newline.

[Mick]

Does it produce an error when you run the search manually?