topic How can I extract address from string? in Splunk Search

How can I extract address from string?

Annieg — Tue, 07 Mar 2023 15:24:48 GMT

I have the following string:

I want to extract the address from this. I have tried regex with %20 and split but nothing works.

PickleRick — Mon, 06 Mar 2023 20:20:33 GMT

Use urldecode(). Like this:

| makeresults 
| eval a="SL=5601%20BLVD%20E%2C%20WESTON%20NEW%20YORK%2C%20NJ%20%2007093%20(WEST%20NEW%20YORK%20TOWN%2C%20HUDS"
| eval b=urldecode(a)

BTW, you pasted whole URL to your Splunk environment. You should be more careful. Next time it might contain sensitive info.