urldecode works for decoding the values of URL addresses and strings Try the below examples: with url : | makeresults | eval field1= "f%23has%2Bofh%20a" | eval field1 = urldecode(field1) with string: For example you already have field value then, | rex mode=sed field=field1 "s/ / /g" | eval a=urldecode(field1) ... View more