Splunk Search

Searching for fields after pipeline

balidani
Explorer

Hello!

When I run the following search it works perfectly:

inc=* | head 2

However if the search is after a pipeline I get an error:

http 200 | inc=* | head 2

The error I get is:

Search operation 'inc' is unknown. You might not have permission to run this operation.

What am I doing wrong?
Thanks in advance!

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

When you pipe to something it need an actual splunk command. So you could do this http 200 | search inc=* | head 2. However you should always limit the search before piping to a command so "http 200 inc=* | head 2" would be the search you want.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

When you pipe to something it need an actual splunk command. So you could do this http 200 | search inc=* | head 2. However you should always limit the search before piping to a command so "http 200 inc=* | head 2" would be the search you want.

View solution in original post

balidani
Explorer

Thank you! This is what I was looking for, I didn't realise I can do it without a pipe between http 200 and inc=...

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!