How to Eval urldecode and then regex?

[Log_wrangler]

I have some URL encoded logs.

...| eval decoded_raw = urldecode(_raw)

how would I write a rex to find any decoded_raw values containing "error", is it possible to pass the urldecoded field into a regex? or can you regex the eval-ed / decoded field?

Thank you

[Log_wrangler]

Thank you for your answers, I was actually trying to do this...

index=my_index sourcetype=my_sourcetype  | eval decoded_raw = urldecode(_raw) | rex field=decoded_raw "(?<new_field_name> SecurityError.+)" |stats values (new_field_name)

But I was wondering if there is a better way to do this or if this leads to issues

[woodcock]

Now wait just a minute. First of all, it is exceedingly unlikely that _raw consists only of a URL. It is also exceedingly unlikely that _raw is entirely urlencoded. Furthermote, even if it were, the contiguous string error would be encoded as, error so there is no need to decode it. So you should be able to just do:

index=YouShouldAlwaysSpecifyIndex *error*

Or, if you really do have a URL field, maybe:

index=YouShouldAlwaysSpecifyIndex URL="*error*"

[Log_wrangler]

thank you for your reply, I agree but, if I don't decode, the error message is url encoded garble.

I might see if it is faster to rex first and then decode.

thanks

[DalJeanis · Accepted solution]

Yes to all of the above. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex

| rex field=decoded_raw "(?<errorfound>error)"

After the above statement, the field errorfound will contain the value "error" if field decoded_raw contained any substring that matched "error".

You can also use match() or like() to achieve a test. https://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/ConditionalFunctions

| eval errorfound=if(match(decoded_raw,"error"),""error","no error")