I'm getting error an on piping one command into another. The result is a "Search operation 'earliest' is unknown. You might not have permission to run this operation."
Both commands work individually, not sure why I can't pipe the output of one into the other. I'd like to know why this fails if you don't find.
First Query
index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence
Second Query
index=myapp earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift
Combined Query
index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence | earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift
earliest is not a command you can pipe to. It must be part of your base search.
earliest is not a command you can pipe to. It must be part of your base search.
Perhaps you can accept the answer?
Perfect. Thanks!!