Hello!
When I run the following search it works perfectly:
inc=* | head 2
However if the search is after a pipeline I get an error:
http 200 | inc=* | head 2
The error I get is:
Search operation 'inc' is unknown. You might not have permission to run this operation.
What am I doing wrong?
Thanks in advance!
When you pipe to something it need an actual splunk command. So you could do this http 200 | search inc=* | head 2. However you should always limit the search before piping to a command so "http 200 inc=* | head 2" would be the search you want.
When you pipe to something it need an actual splunk command. So you could do this http 200 | search inc=* | head 2. However you should always limit the search before piping to a command so "http 200 inc=* | head 2" would be the search you want.
Thank you! This is what I was looking for, I didn't realise I can do it without a pipe between http 200 and inc=...