Splunk Search

URL Decoding- How to resolve error?

yonphang
Explorer

i tried all splunk answers and doesn't seems like working for me.

i have this

search | rex mode=sed field=message.UA "s/%2f///g" | table message.UA

sample message.UA
Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36

i got this error after ran the search above.

Error in 'rex' command: Failed to initialize sed. Invalid option string: /g

I tried urldecode function, doesn't work, and also tried almost every solutions from splunk answer, i just could not decode the encoded UA field. please help.

Labels (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

How about eval's urldecode?

| eval decoded=urldecode(yourEncodedField)

or

| eval decoded=urldecode("yourEncodedString")

https://docs.splunk.com/Documentation/SCS/current/SearchReference/TextFunctions#urldecode.28.26lt.3B...

Tags (1)
0 Karma

rafamss
Contributor

I used your example, and it worked for me. Did you try this way?

| makeresults 
| eval ua = "Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36"
| eval uadecoded = urldecode(ua)

rafamss_0-1607455524054.png

 

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@yonphang ,

Try

 |rex mode=sed field=url "s/%2f/\//g"
Happy Splunking!
0 Karma

yonphang
Explorer

yes that was intentional, i want to find %2f and replace into /

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Ok updated the answer

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...