Use a Function without Running a Search

[pfernandez133]

Hey guys, is it possible to run an eval function in the search bar without piping a search to it?

In an attempt to test the urldecode function, I'm trying to run the following on the search bar:

| eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | search x!=""

I'm just trying to see what that urldecode function will do with that string, but, I would like to be able to do something like this with other functions in the future.

Any thoughts?

Thanks!

[somesoni2]

There are multiple options, here are 2 of them

|stats count | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | fields - count | search x!=""


| gentimes start=-1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") | table x | search x!=""

[pfernandez133]

That works, thanks!

[bkirk]

This is a search but you throw out the results and just return the results of your eval function:

sourcetype="lsof" |head 1 | eval x=urldecode("http%3A%2F%2Fwww.blah.com%2Fsomething%2Fsomething-something") |table x

You can use any sourcetype, I just picked one that should available for everyone.

[pfernandez133]

That also works, thanks!