When do you put a | (pipe) as the first character in a search

[coleman07]

I have noticed several search commands which are preceded by a pipe character with no input left of the pipe. For example:
|eventcount index=*

I looked at what would happen without the pipe and the results were all lines in the searched indexes with the word eventcount. How do you determine whether you must precede a search function with a pipe? Would you also explain what splunk is doing when it sees a pipe without input?

Thank you.

[verbal_666]

Ok, this is "etically" perfect right, but i really need a field count = 0 for ALL next fields, this is the base from where i was starting to generate a next report from a previous Generating Report.

OK, the "concept" is different (Generating Commands or Trasforming Commands), but what i did with "stats" gave me what i need without reported errors.

With the " | stats count | eval l="a,b,c" | makemv delim="," l | mvexpand l " will give it without errors e no effort for system,
with the " | makeresults | fields - _time | eval count = 0 | eval data="a,b,c" | makemv delim="," data | mvexpand data ", i need one more added field ("eval count = 0"), and delete another one "fields - _time".

In my opinion, "|stats" is working fine and i keep on using it.

Thanks, anyway.

[niketn]

The command this question is looking for is called Generating Command.

While |stats count mimics a generating (report) command scenario as in presence of no events it gives count as 0 instead of no results found, it is actually a ** transforming command ** which is used to generate report (aggregate data).

makeresults or gentimes generating commands can be used instead! Several examples exist for this on Splunk Answers and in Splunk Documentation.

| makeresults 
| fields - _time
| eval data="a,b,c" 
| makemv delim="," data
| mvexpand data

[verbal_666]

Also "stats" can be a | command. Ex. "| stats count" will result in 0.

Very useful if you want a base matrix to run a next one search starting from a base "fake search" with needed existing fields.

Try

" | stats count | eval l="a,b,c" | makemv delim="," l | mvexpand l "

[erhoward]

"inputcsv" is another command where you could begin the command with a pipe.,"inputcsv" is another command where you would begin the command with a pipe.

[lguinn2]

Splunk expects the first tokens to be search terms or operators. BUT if the first token is the pipe |, Splunk knows that what follows is NOT a search command, and that it should not search the index(es) for the data.

Beginning a "search" with a pipe is only valid for a few commands (the ones that don't need to retrieve indexed data). Here are a few, I am sure there are others

• inputlookup
• eventcount
• metadata