topic Re: Use a Function without Running a Search in Splunk Search

Use a Function without Running a Search

pfernandez133 — Wed, 18 Jun 2014 18:42:07 GMT

Hey guys, is it possible to run an eval function in the search bar without piping a search to it?

In an attempt to test the urldecode function, I'm trying to run the following on the search bar:

| eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | search x!=""

I'm just trying to see what that urldecode function will do with that string, but, I would like to be able to do something like this with other functions in the future.

Any thoughts?

Thanks!

Re: Use a Function without Running a Search

bkirk — Wed, 18 Jun 2014 19:14:34 GMT

This is a search but you throw out the results and just return the results of your eval function:

sourcetype="lsof" |head 1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") |table x

You can use any sourcetype, I just picked one that should available for everyone.

Re: Use a Function without Running a Search

somesoni2 — Wed, 18 Jun 2014 19:25:18 GMT

There are multiple options, here are 2 of them

|stats count | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | fields - count | search x!=""


| gentimes start=-1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | table x | search x!=""

Re: Use a Function without Running a Search

pfernandez133 — Wed, 18 Jun 2014 21:05:33 GMT

That works, thanks!

Re: Use a Function without Running a Search

pfernandez133 — Wed, 18 Jun 2014 21:05:49 GMT

That also works, thanks!