Splunk Search

Does Splunk have an echo command

Builder

Does Splunk have a command that could be used in the search field that would echo the response in the search results. It would operate similar to a Linux echo.

echo foo

> foo

Thanks

1 Solution

SplunkTrust
SplunkTrust

Try this:

| stats count as echo | eval echo = "foo"

That'll produce one result with a field echo and a value "foo".

View solution in original post

Splunk Employee
Splunk Employee

You can also do:

| localop | stats count | eval myliteral="Whatever" | table myliteral
0 Karma

SplunkTrust
SplunkTrust

Try this:

| stats count as echo | eval echo = "foo"

That'll produce one result with a field echo and a value "foo".

View solution in original post

Explorer

Why is the first | in front of stats needed? You don't need it to do just a search, but this stats command does not work without it. Thank you.

0 Karma

SplunkTrust
SplunkTrust

Without the pipe you're searching for the word "stats" .

Note, by now there is the explicit command | makeresults to create an empty result, it's slightly more efficient than stats and much more readable.

Builder

Worked great, thanks.

0 Karma

Motivator

there no command in splunk that function exactly like the command ech of linux. but from a combination of command you get the result that you want .

and Display High values of a field , you can use commands such as "table"; "field" .....
to change the field values you use the "eval"; ...

you can use macro to simulate aproche

or map command, see this example can help you:

sourcetype=syslog sudo | stats count by user host | map search="search
index=ad_summary username=$user$ type_logon=ad_last_logon"
0 Karma

Builder

Not sure that will do the trick. Sorry. Can you be more precise? In fact, that answer looks like a direct copy and paste from an unrelated question and answer.

0 Karma

Path Finder

|eval column='literal'

0 Karma

Builder

When entered in the search bar, no results are found. Can you please be more specific? Thanks.

0 Karma

SplunkTrust
SplunkTrust

What are you trying to achieve?

0 Karma

Builder

Enter something in the search bar and it is returned in the search results. Similar to echo.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!