Hey guys, is it possible to run an eval function in the search bar without piping a search to it?
In an attempt to test the urldecode function, I'm trying to run the following on the search bar:
| eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | search x!=""
I'm just trying to see what that urldecode function will do with that string, but, I would like to be able to do something like this with other functions in the future.
Any thoughts?
Thanks!
There are multiple options, here are 2 of them
|stats count | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | fields - count | search x!=""
| gentimes start=-1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | table x | search x!=""
That works, thanks!
This is a search but you throw out the results and just return the results of your eval function:
sourcetype="lsof" |head 1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") |table x
You can use any sourcetype, I just picked one that should available for everyone.
That also works, thanks!