parse_url

This page explains how to use the parse_url function in APL.

The parse_url function parses an absolute URL string into a dynamic object containing all URL components (scheme, host, port, path, query parameters, etc.). Use this function to extract and analyze specific parts of URLs from logs, web traffic data, or API requests.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use rex or URL-specific extractions. APL’s parse_url provides structured URL parsing in one function.

Splunk example

| rex field=url "(?<scheme>https?)://(?<host>[^/]+)(?<path>.*)"

ANSI SQL users

In ANSI SQL, URL parsing requires complex string manipulation. APL’s parse_url provides structured parsing natively.

SQL example

SELECT SUBSTRING_INDEX(SUBSTRING_INDEX(url, '://', -1), '/', 1) AS host FROM logs;

Usage

Syntax

parse_url(url)

Parameters

Name	Type	Required	Description
url	string	Yes	An absolute URL string to parse.

Returns

Returns a dynamic object containing URL components: scheme, host, port, path, username, password, query, fragment.

Use case examples

Log analysis

Parse URLs from HTTP logs to analyze traffic patterns by host and path.

Query

['sample-http-logs']
| extend full_url = strcat('https://api.example.com', uri)
| extend parsed = parse_url(full_url)
| extend host = tostring(parsed.host)
| extend path = tostring(parsed.path)
| summarize request_count = count() by host, path
| sort by request_count desc
| limit 10

Run in Playground

Output

host	path	request_count
api.example.com	/api/users	2341
api.example.com	/api/orders	1987
api.example.com	/api/products	1654

This query parses complete URLs to extract host and path information for traffic analysis and API endpoint usage patterns.

List of related functions

• parse_urlquery: Parses only URL query parameters. Use this when you only need query string parsing.
• format_url: Constructs URLs from components. Use this to reverse the parsing operation and build URLs.
• url_decode: Decodes URL-encoded strings. Use this to decode individual URL components.
• split: Splits strings by delimiters. Use this for simpler URL tokenization without full parsing.