Splunk Search

Use a Function without Running a Search

pfernandez133
Explorer

Hey guys, is it possible to run an eval function in the search bar without piping a search to it?

In an attempt to test the urldecode function, I'm trying to run the following on the search bar:

| eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | search x!=""

I'm just trying to see what that urldecode function will do with that string, but, I would like to be able to do something like this with other functions in the future.

Any thoughts?

Thanks!

Tags (3)
0 Karma

somesoni2
Revered Legend

There are multiple options, here are 2 of them

|stats count | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | fields - count | search x!=""


| gentimes start=-1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | table x | search x!=""

pfernandez133
Explorer

That works, thanks!

0 Karma

bkirk
Path Finder

This is a search but you throw out the results and just return the results of your eval function:

sourcetype="lsof" |head 1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") |table x

You can use any sourcetype, I just picked one that should available for everyone.

0 Karma

pfernandez133
Explorer

That also works, thanks!

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on