Required arguments

Optional arguments

Multiply each value in an array by a specific number

Consider this set of data:

The following search loops through the array values in the results field and multiplies each array value by 10. This example uses a lambda expression where $r represents the current element in the array.

... | eval new_results = map(results, $r -> $r*10)

The results look like this:

Using multiple function statements

To specify multiple function statements in your lambda expression, you must separate each statement with a semi-colon ( ; ).

Consider this set of data, where the cities field contains an array of city names:

The following search uses the map function to loop through the array values in the cities field and prepend a string to each value. The lambda expression has 2 function statements: 1 assignment statement and 1 return statement. The assignment statement prepends the string emea_ to each value in the array. The return statement returns the results of the assignment statement as a new field called regionCities.

from worldDataset select map(cities, ($val) -> { $region = "emea_" + $val; return $region; }) as regionCities

The results look like this:

Normalize JSON

Sometimes you encounter JSON data that is formatted in such a way that Splunk platforms can't parse the JSON data. One example is data that consists of key-value pairs inside an array of objects where both the keys and values are stored as values. You can use lambda expressions to normalize JSON data.

The following search takes an array that consists of a set of objects. The search uses the eval command with the reduce function to pull the keys out of each object and place the results in a new field called "keyvals". The reduce function iterates over the values in a JSON array and performs an operation on each value in the array.

$basic = from [{array:[{key:"one", n:1},{key:"two", n:2},
{key:"three", n:3}]}] 
| eval keyvals=reduce(array, {}, ($acc, $it) -> json_set_exact($acc, 
$it.key, $it.n)) 

Here is what occurs when the reduce function iterates over the values in the array:

The results look like this:

For more information about the reduce function, see JSON functions in the SPL2 Search Reference.

Apply a normalizer function to a URL

Consider the following function, which decodes and normalizes URLs:

function normalizeDecodeURL($input: string, $beforeDecode: func, $afterDecode: func): string {
  $readyForDecode = $beforeDecode($input)
  $decoded = urldecode($readyForDecode)
  return $afterDecode($decoded)
}

This function defines three parameters:

• $input accepts string values, which will be the URLs.
• $beforeDecode must be a lambda expression.
• $afterDecode must be a lambda expression.

The following example shows how the normalizeDecodeURL function is used in a search:

$search1 = from main 
| eval decodedURL = normalizeDecodeURL(url, $raw -> trim($raw, " "), $decoded -> substr($decoded, 0, 100))

This search:

• Creates a field called decodedURL
• Uses the custom function normalizeDecodeURL
• For the first function parameter, specifies a field in the events called url
• For the second function parameter, specifies a lambda expression that takes the original URL and trims any spaces before and after the URL
• For the third function parameter, specifies a lambda expression that takes the decoded URL and returns the first 100 characters of the URL string