Splunk Search

URL Decoding

yonphang
Explorer

i tried all splunk answers and doesn't seems like working for me.

i have this

search | rex mode=sed field=message.UA "s/%2f///g" | table message.UA

sample message.UA
Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36

i got this error after ran the search above.

Error in 'rex' command: Failed to initialize sed. Invalid option string: /g

I tried urldecode function, doesn't work, and also tried almost every solutions from splunk answer, i just could not decode the encoded UA field. please help.

0 Karma

rafamss
Contributor

I used your example, and it worked for me. Did you try this way?

| makeresults 
| eval ua = "Mozilla%2f5.0%20(X11%3b%20Linux%20x86_64)%20AppleWebKit%2f537.36%20(KHTML,%20like%20Gecko)%20Chrome%2f70.0.3538.77%20Safari%2f537.36"
| eval uadecoded = urldecode(ua)

rafamss_0-1607455524054.png

 

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@yonphang ,

Try

 |rex mode=sed field=url "s/%2f/\//g"
0 Karma

yonphang
Explorer

yes that was intentional, i want to find %2f and replace into /

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Ok updated the answer

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!