Searching for fields after pipeline

[balidani]

Hello!

When I run the following search it works perfectly:

inc=* | head 2

However if the search is after a pipeline I get an error:

http 200 | inc=* | head 2

The error I get is:

Search operation 'inc' is unknown. You might not have permission to run this operation.

What am I doing wrong?
Thanks in advance!

[sdaniels · Accepted solution]

When you pipe to something it need an actual splunk command. So you could do this http 200 | search inc=* | head 2. However you should always limit the search before piping to a command so "http 200 inc=* | head 2" would be the search you want.

[balidani]

Thank you! This is what I was looking for, I didn't realise I can do it without a pipe between http 200 and inc=...