How do I decode this character in Splunk?
'
I tried | eval decode=urldecode(DESC)
and no change.
It's obviously a single quote (apostrophe).
It's just a string field like this:
Splunk's Favorite Color
A similar question at alternatives to urldecode
The following table lists the ascii7 characters as HTML entities HTML Codes Table
The HTML numbers are the Unicode numbers, so a general function should be able to convert the HTML entity to a utf-8 character but I don't see such a function. Meanwhile you can use the way described in the thread -