Splunk Search

error piping commands

DTERM
Contributor

I'm getting error an on piping one command into another. The result is a "Search operation 'earliest' is unknown. You might not have permission to run this operation."

Both commands work individually, not sure why I can't pipe the output of one into the other. I'd like to know why this fails if you don't find.

First Query

index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

Second Query

index=myapp earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

Combined Query

index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence | earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

Tags (2)
0 Karma
1 Solution

rroberts
Splunk Employee
Splunk Employee

earliest is not a command you can pipe to. It must be part of your base search.

View solution in original post

rroberts
Splunk Employee
Splunk Employee

earliest is not a command you can pipe to. It must be part of your base search.

melting
Splunk Employee
Splunk Employee

Perhaps you can accept the answer?

0 Karma

DTERM
Contributor

Perfect. Thanks!!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...