error piping commands

[DTERM]

I'm getting error an on piping one command into another. The result is a "Search operation 'earliest' is unknown. You might not have permission to run this operation."

Both commands work individually, not sure why I can't pipe the output of one into the other. I'd like to know why this fails if you don't find.

First Query

index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

Second Query

index=myapp earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

Combined Query

index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence | earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

[rroberts · Accepted solution]

earliest is not a command you can pipe to. It must be part of your base search.

[melting]

Perhaps you can accept the answer?

[DTERM]

Perfect. Thanks!!