Splunk Search

URL Decoding- How to resolve error?

yonphang
Explorer

i tried all splunk answers and doesn't seems like working for me.

i have this

search | rex mode=sed field=message.UA "s/%2f///g" | table message.UA

sample message.UA
Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36

i got this error after ran the search above.

Error in 'rex' command: Failed to initialize sed. Invalid option string: /g

I tried urldecode function, doesn't work, and also tried almost every solutions from splunk answer, i just could not decode the encoded UA field. please help.

Labels (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

How about eval's urldecode?

| eval decoded=urldecode(yourEncodedField)

or

| eval decoded=urldecode("yourEncodedString")

https://docs.splunk.com/Documentation/SCS/current/SearchReference/TextFunctions#urldecode.28.26lt.3B...

Tags (1)
0 Karma

rafamss
Contributor

I used your example, and it worked for me. Did you try this way?

| makeresults 
| eval ua = "Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36"
| eval uadecoded = urldecode(ua)

rafamss_0-1607455524054.png

 

0 Karma

renjith_nair
Legend

@yonphang ,

Try

 |rex mode=sed field=url "s/%2f/\//g"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

yonphang
Explorer

yes that was intentional, i want to find %2f and replace into /

0 Karma

renjith_nair
Legend

Ok updated the answer

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...