Splunk Search

Does Splunk have an echo command

TonyLeeVT
Builder

Does Splunk have a command that could be used in the search field that would echo the response in the search results. It would operate similar to a Linux echo.

echo foo

> foo

Thanks

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

| stats count as echo | eval echo = "foo"

That'll produce one result with a field echo and a value "foo".

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

You can also do:

| localop | stats count | eval myliteral="Whatever" | table myliteral
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this:

| stats count as echo | eval echo = "foo"

That'll produce one result with a field echo and a value "foo".

pacmac
Explorer

Why is the first | in front of stats needed? You don't need it to do just a search, but this stats command does not work without it. Thank you.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Without the pipe you're searching for the word "stats" .

Note, by now there is the explicit command | makeresults to create an empty result, it's slightly more efficient than stats and much more readable.

TonyLeeVT
Builder

Worked great, thanks.

0 Karma

fdi01
Motivator

there no command in splunk that function exactly like the command ech of linux. but from a combination of command you get the result that you want .

and Display High values of a field , you can use commands such as "table"; "field" .....
to change the field values you use the "eval"; ...

you can use macro to simulate aproche

or map command, see this example can help you:

sourcetype=syslog sudo | stats count by user host | map search="search
index=ad_summary username=$user$ type_logon=ad_last_logon"
0 Karma

TonyLeeVT
Builder

Not sure that will do the trick. Sorry. Can you be more precise? In fact, that answer looks like a direct copy and paste from an unrelated question and answer.

0 Karma

nadid
Path Finder

|eval column='literal'

0 Karma

TonyLeeVT
Builder

When entered in the search bar, no results are found. Can you please be more specific? Thanks.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What are you trying to achieve?

0 Karma

TonyLeeVT
Builder

Enter something in the search bar and it is returned in the search results. Similar to echo.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...