topic Re: Does Splunk have an echo command in Splunk Search

Does Splunk have an echo command

TonyLeeVT — Sat, 28 Mar 2015 11:13:46 GMT

Does Splunk have a command that could be used in the search field that would echo the response in the search results. It would operate similar to a Linux echo.

echo foo

> foo

Thanks

Re: Does Splunk have an echo command

martin_mueller — Sat, 28 Mar 2015 12:22:33 GMT

What are you trying to achieve?

Re: Does Splunk have an echo command

nadid — Sat, 28 Mar 2015 14:47:22 GMT

|eval column='literal'

Re: Does Splunk have an echo command

fdi01 — Sat, 28 Mar 2015 16:38:43 GMT

there no command in splunk that function exactly like the command ech of linux. but from a combination of command you get the result that you want .

and Display High values of a field , you can use commands such as "table"; "field" .....
to change the field values you use the "eval"; ...

you can use macro to simulate aproche

or map command, see this example can help you:

sourcetype=syslog sudo | stats count by user host | map search="search
index=ad_summary username=$user$ type_logon=ad_last_logon"

Re: Does Splunk have an echo command

TonyLeeVT — Sat, 28 Mar 2015 21:54:22 GMT

When entered in the search bar, no results are found. Can you please be more specific? Thanks.

Re: Does Splunk have an echo command

TonyLeeVT — Sat, 28 Mar 2015 21:55:01 GMT

Enter something in the search bar and it is returned in the search results. Similar to echo.

Re: Does Splunk have an echo command

TonyLeeVT — Sat, 28 Mar 2015 22:00:06 GMT

Not sure that will do the trick. Sorry. Can you be more precise? In fact, that answer looks like a direct copy and paste from an unrelated question and answer.

Re: Does Splunk have an echo command

martin_mueller — Sat, 28 Mar 2015 22:34:15 GMT

Try this:

| stats count as echo | eval echo = "foo"

That'll produce one result with a field echo and a value "foo".

Re: Does Splunk have an echo command

TonyLeeVT — Sat, 28 Mar 2015 22:40:39 GMT

Worked great, thanks.

Re: Does Splunk have an echo command

esix_splunk — Sun, 29 Mar 2015 01:13:53 GMT

You can also do:

| localop | stats count | eval myliteral="Whatever" | table myliteral

Re: Does Splunk have an echo command

pacmac — Thu, 12 Dec 2019 08:19:40 GMT

Why is the first | in front of stats needed? You don't need it to do just a search, but this stats command does not work without it. Thank you.

Re: Does Splunk have an echo command

martin_mueller — Thu, 12 Dec 2019 14:23:14 GMT

Without the pipe you're searching for the word "stats" .

Note, by now there is the explicit command | makeresults to create an empty result, it's slightly more efficient than stats and much more readable.