Does Splunk have an echo command

[TonyLeeVT]

Does Splunk have a command that could be used in the search field that would echo the response in the search results. It would operate similar to a Linux echo.

echo foo

> foo

Thanks

[esix_splunk]

You can also do:

| localop | stats count | eval myliteral="Whatever" | table myliteral

[martin_mueller · Accepted solution]

Try this:

| stats count as echo | eval echo = "foo"

That'll produce one result with a field echo and a value "foo".

[pacmac]

Why is the first | in front of stats needed? You don't need it to do just a search, but this stats command does not work without it. Thank you.

[martin_mueller]

Without the pipe you're searching for the word "stats" .

Note, by now there is the explicit command | makeresults to create an empty result, it's slightly more efficient than stats and much more readable.

[TonyLeeVT]

Worked great, thanks.

[fdi01]

there no command in splunk that function exactly like the command ech of linux. but from a combination of command you get the result that you want .

and Display High values of a field , you can use commands such as "table"; "field" .....
to change the field values you use the "eval"; ...

you can use macro to simulate aproche

or map command, see this example can help you:

sourcetype=syslog sudo | stats count by user host | map search="search
index=ad_summary username=$user$ type_logon=ad_last_logon"

[TonyLeeVT]

Not sure that will do the trick. Sorry. Can you be more precise? In fact, that answer looks like a direct copy and paste from an unrelated question and answer.

[nadid]

|eval column='literal'

[TonyLeeVT]

When entered in the search bar, no results are found. Can you please be more specific? Thanks.

[martin_mueller]

What are you trying to achieve?

[TonyLeeVT]

Enter something in the search bar and it is returned in the search results. Similar to echo.