topic Re: URL Decoding in Splunk Search

URL Decoding- How to resolve error?

yonphang — Fri, 30 Jun 2023 15:42:03 GMT

i tried all splunk answers and doesn't seems like working for me.

i have this

search | rex mode=sed field=message.UA "s/%2f///g" | table message.UA

sample message.UA
Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36

i got this error after ran the search above.

Error in 'rex' command: Failed to initialize sed. Invalid option string: /g

I tried urldecode function, doesn't work, and also tried almost every solutions from splunk answer, i just could not decode the encoded UA field. please help.

Re: URL Decoding

renjith_nair — Wed, 30 Oct 2019 05:07:55 GMT

@yonphang ,

Try

 |rex mode=sed field=url "s/%2f/\//g"

Re: URL Decoding

yonphang — Wed, 30 Oct 2019 05:43:38 GMT

yes that was intentional, i want to find %2f and replace into /

Re: URL Decoding

renjith_nair — Wed, 30 Oct 2019 05:46:12 GMT

Ok updated the answer

Re: URL Decoding

rafamss — Tue, 08 Dec 2020 19:26:16 GMT

I used your example, and it worked for me. Did you try this way?

| makeresults | eval ua = "Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36" | eval uadecoded = urldecode(ua)

Re: URL Decoding

jkat54 — Thu, 29 Jun 2023 13:12:11 GMT

How about eval's urldecode?

| eval decoded=urldecode(yourEncodedField)

or

| eval decoded=urldecode("yourEncodedString")

https://docs.splunk.com/Documentation/SCS/current/SearchReference/TextFunctions#urldecode.28.26lt.3Burl.26gt.3B.29