Splunk Search

Use a Function without Running a Search

pfernandez133
Explorer

Hey guys, is it possible to run an eval function in the search bar without piping a search to it?

In an attempt to test the urldecode function, I'm trying to run the following on the search bar:

| eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | search x!=""

I'm just trying to see what that urldecode function will do with that string, but, I would like to be able to do something like this with other functions in the future.

Any thoughts?

Thanks!

Tags (3)
0 Karma

somesoni2
Revered Legend

There are multiple options, here are 2 of them

|stats count | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | fields - count | search x!=""


| gentimes start=-1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | table x | search x!=""

pfernandez133
Explorer

That works, thanks!

0 Karma

bkirk
Path Finder

This is a search but you throw out the results and just return the results of your eval function:

sourcetype="lsof" |head 1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") |table x

You can use any sourcetype, I just picked one that should available for everyone.

0 Karma

pfernandez133
Explorer

That also works, thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...