url_decode

This page explains how to use the url_decode function in APL.

The url_decode function converts a URL-encoded string back to its original format. Use this function to decode query parameters, analyze encoded URIs, or extract readable text from URL-encoded log data.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use urldecode. APL’s url_decode provides the same functionality.

Splunk example

| eval decoded=urldecode(field)

ANSI SQL users

In ANSI SQL, URL decoding varies by database. APL’s url_decode provides standardized URL decoding.

SQL example

SELECT URL_DECODE(field) AS decoded FROM logs;

Usage

Syntax

url_decode(encoded_url)

Parameters

Name	Type	Required	Description
encoded_url	string	Yes	The URL-encoded string to decode.

Returns

Returns the decoded string in regular representation.

Use case examples

Log analysis

Decode URL-encoded query parameters to analyze user search terms and inputs.

Query

['sample-http-logs']
| extend decoded_uri = url_decode(uri)
| where decoded_uri != uri
| project _time, uri, decoded_uri, method, status
| limit 10

Run in Playground

Output

_time	uri	decoded_uri	method	status
2024-11-06T10:00:00Z	/search?q=hello%20world	/search?q=hello world	GET	200
2024-11-06T10:01:00Z	/api?name=John%20Doe	/api?name=John Doe	GET	200

This query decodes URL-encoded URIs to reveal the actual search terms and parameters used by users.

List of related functions

• url_encode: Encodes strings for URL transmission. Use this to reverse the decoding operation.
• parse_url: Parses URLs into components. Use this after url_decode for full URL analysis.
• parse_urlquery: Parses URL query strings. Use this with url_decode to extract query parameters.
• base64_decode_tostring: Decodes Base64 strings. Use this for Base64 encoding rather than URL encoding.