Splunk Search

URL Decoding- How to resolve error?

yonphang
Explorer

i tried all splunk answers and doesn't seems like working for me.

i have this

search | rex mode=sed field=message.UA "s/%2f///g" | table message.UA

sample message.UA
Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36

i got this error after ran the search above.

Error in 'rex' command: Failed to initialize sed. Invalid option string: /g

I tried urldecode function, doesn't work, and also tried almost every solutions from splunk answer, i just could not decode the encoded UA field. please help.

Labels (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

How about eval's urldecode?

| eval decoded=urldecode(yourEncodedField)

or

| eval decoded=urldecode("yourEncodedString")

https://docs.splunk.com/Documentation/SCS/current/SearchReference/TextFunctions#urldecode.28.26lt.3B...

Tags (1)
0 Karma

rafamss
Contributor

I used your example, and it worked for me. Did you try this way?

| makeresults 
| eval ua = "Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36"
| eval uadecoded = urldecode(ua)

rafamss_0-1607455524054.png

 

0 Karma

renjith_nair
Legend

@yonphang ,

Try

 |rex mode=sed field=url "s/%2f/\//g"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

yonphang
Explorer

yes that was intentional, i want to find %2f and replace into /

0 Karma

renjith_nair
Legend

Ok updated the answer

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...