Splunk Search

Searching for fields after pipeline

balidani
Explorer

Hello!

When I run the following search it works perfectly:

inc=* | head 2

However if the search is after a pipeline I get an error:

http 200 | inc=* | head 2

The error I get is:

Search operation 'inc' is unknown. You might not have permission to run this operation.

What am I doing wrong?
Thanks in advance!

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

When you pipe to something it need an actual splunk command. So you could do this http 200 | search inc=* | head 2. However you should always limit the search before piping to a command so "http 200 inc=* | head 2" would be the search you want.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

When you pipe to something it need an actual splunk command. So you could do this http 200 | search inc=* | head 2. However you should always limit the search before piping to a command so "http 200 inc=* | head 2" would be the search you want.

balidani
Explorer

Thank you! This is what I was looking for, I didn't realise I can do it without a pipe between http 200 and inc=...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...