Splunk Search

error piping commands

DTERM
Contributor

I'm getting error an on piping one command into another. The result is a "Search operation 'earliest' is unknown. You might not have permission to run this operation."

Both commands work individually, not sure why I can't pipe the output of one into the other. I'd like to know why this fails if you don't find.

First Query

index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

Second Query

index=myapp earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

Combined Query

index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence | earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

Tags (2)
0 Karma
1 Solution

rroberts
Splunk Employee
Splunk Employee

earliest is not a command you can pipe to. It must be part of your base search.

View solution in original post

rroberts
Splunk Employee
Splunk Employee

earliest is not a command you can pipe to. It must be part of your base search.

View solution in original post

melting
Splunk Employee
Splunk Employee

Perhaps you can accept the answer?

0 Karma

DTERM
Contributor

Perfect. Thanks!!

0 Karma