Skip to main content
Sumo Logic

urldecode

The URL Decode (urldecode) operator decodes a URL you include in a query, returning the decoded (unescaped) URL string.

For example, a URL that looks like this:

url%3D%2Fscience%2FUserActions%2Farticle%2FrightPane%2Fserial%2FdisplayRightPanePanel%2FciteRelatedArt...

can be decoded to:

url=/science/UserActions/article/rightPane/serial/displayRightPanePanel...

Syntax:

  • urldecode(url_to_be_decoded)

Example

Let's say you'd like to decode URLs connecting to your firewall. Running a query like:

http: | parse "Connecting to firewall at URL: *" as url
| urldecode(url) as decoded

returns results of each URL, both in the encoded and decoded state, allowing you to run additional queries on the parsed, decoded URLs.