topic Re: URLDECODE in Splunk Search

URLDECODE

erlindemberg — Fri, 24 Jan 2020 18:17:00 GMT

I would like to know how can I use the urldecorder command for all URLs in the reqHdr.referer field (Akamai)

index=akamai
| eval newfield = urldecode("https%3a%2f%2fwww....................%2f")
| table newfield

Re: URLDECODE

richgalloway — Fri, 24 Jan 2020 18:26:35 GMT

What results do you get and what results do you expect?

Re: URLDECODE

erlindemberg — Fri, 24 Jan 2020 18:39:11 GMT

In this case, if I specify a single URL in this field it will bring me the result of the decoded URL.
However, the field has thousands of other URLs.

The result I hope is that all URLs are shown decrypted.

Re: URLDECODE

jkat54 — Fri, 24 Jan 2020 18:39:46 GMT

 ... | eval newField=urldecode('reqHdr.referer') | table newField

Re: URLDECODE

erlindemberg — Fri, 24 Jan 2020 18:43:56 GMT

I've tried and the field doesn't show the URLs, just the name reqHdr.referer

Re: URLDECODE

richgalloway — Fri, 24 Jan 2020 18:59:26 GMT

Can you share some sample data?

Re: URLDECODE

erlindemberg — Fri, 24 Jan 2020 19:16:31 GMT

Using this query:

index=c4_akamai
| eval newfield = urldecode("reqHdr.referer")
| table newfield

o resultado é:

newfield
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer
reqHdr.referer

Eu usando apenas uma URL de referencia dentro do campo reqHdr.referer o resultado é:

index=c4_akamai
| eval newfield = urldecode("https%3a%2f%2fwww.*******.com.br%2f")
| table newfield

newfield
https://www.**********.com.br/
https://www.**********.com.br/
https://www.**********.com.br/
https://www.**********.com.br/
https://www.**********.com.br/
https://www.**********.com.br/
https://www.**********.com.br/

Re: URLDECODE

erlindemberg — Fri, 24 Jan 2020 19:16:37 GMT

Using this query:

index=c4_akamai
| eval newfield = urldecode("reqHdr.referer")
| table newfield

o resultado é:

Eu usando apenas uma URL de referencia dentro do campo reqHdr.referer o resultado é:

index=c4_akamai
| eval newfield = urldecode("https%3a%2f%2fwww.*******.com.br%2f")
| table newfield

Re: URLDECODE

richgalloway — Fri, 24 Jan 2020 19:28:29 GMT

Don't use double quotes "around the field name. Try without quotes. If that doesn't work, use single quotes '.

Re: URLDECODE

erlindemberg — Fri, 24 Jan 2020 19:50:46 GMT

Thanks for the help, with single quotes it worked.

Re: URLDECODE

jkat54 — Fri, 24 Jan 2020 20:01:54 GMT

Tried it with single quotes around it?

Re: URLDECODE

snallam123 — Fri, 24 Jan 2020 21:37:54 GMT

index=c4_akamai
| eval newfield = urldecode('reqHdr.referer')
| table newfield