Splunk Search

How can I extract address from string?

Annieg
Observer

I have the following string:

SL=5601%20BLVD%20E%2C%20WESTON%20NEW%20YORK%2C%20NJ%20%2007093%20(WEST%20NEW%20YORK%20TOWN%2C%20HUDS...

I want to extract the address from this. I have tried regex with %20 and split but nothing works. 

Labels (2)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Use urldecode(). Like this:

| makeresults 
| eval a="SL=5601%20BLVD%20E%2C%20WESTON%20NEW%20YORK%2C%20NJ%20%2007093%20(WEST%20NEW%20YORK%20TOWN%2C%20HUDS"
| eval b=urldecode(a)

BTW, you pasted whole URL to your Splunk environment. You should be more careful. Next time it might contain sensitive info.

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...