Skip to main content
The parse_urlquery function parses a URL query string and returns a dynamic object containing the query parameters as key-value pairs. Use this function to extract and analyze query parameters from URLs in logs, API requests, or web traffic data.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use rex or URL parsing to extract query parameters. APL’s parse_urlquery provides structured query string parsing.
| rex field=url "\\?(?<query_string>.*)"
| eval params=split(query_string, "&")
In ANSI SQL, query string parsing requires complex string manipulation. APL’s parse_urlquery provides native parsing.
SELECT SUBSTRING(url, POSITION('?' IN url) + 1) AS query_string FROM logs;

​
Usage

​
Syntax

parse_urlquery(query_string)

​
Parameters

NameTypeRequiredDescription
query_stringstringYesA URL query string (with or without the leading ’?’) to parse.

​
Returns

Returns a dynamic object containing the query parameters as key-value pairs.

​
Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Extract and analyze query parameters from API requests to understand search patterns and filter usage.Query
['sample-http-logs']
| extend query_params = parse_urlquery('page=1&limit=50&sort=date')
| extend page = toint(query_params.page)
| extend limit = toint(query_params.limit)
| extend sort = tostring(query_params.sort)
| summarize request_count = count() by page, limit, sort
| sort by request_count desc
| limit 10
Run in PlaygroundOutput
pagelimitsortrequest_count
150date8765
This query parses query parameters from API requests to analyze pagination and sorting preferences.
  • parse_url: Parses complete URLs into all components. Use this when you need more than just query parameters.
  • url_decode: Decodes URL-encoded strings. Use this to decode individual query parameter values.
  • split: Splits strings by delimiters. Use this for simpler query string tokenization without key-value parsing.
  • parse_json: Parses JSON strings. Use this when working with JSON data rather than URL query strings.