urlDecode - Decode a URL encoded value

In order to transmit values within a URL, values are sometimes URL encoded. When these values are parsed, they should then be decoded.

Syntax

urlDecode(string: string): string

Arguments

Name	Type	Required	Description
string	string	true	The URL encoded string to decode

Example - Converting query string parameters into a JSON Object and URL decoding

Consider the following document:

{
  "domain": "https://www.coralogix.com",
  "path": "/home",
  "query_string": "name=Tom%20Kosman&b=c&c=d"
}

We want to extract each query string parameter into its own object field, which will give us the ability to query on individual query string fields. We can do this using kv.

extract query_string into query_string_parameters using kv(pair_delimiter='&',key_delimiter='=')

The resulting document looks like this:

{
  "domain":"https://www.coralogix.com",
  "query_string":"a=b&b=c&c=d",
  "path": "/home",
  "query_string_parameters":{
    "name":"Tom%20Kosman",
    "b":"c",
    "c":"d"
  }
}

We can see that the parameter name is URL encoded. We can fix this using urlDecode:

replace query_string_parameters.name with query_string_parameters.name.urlDecode()

This results in the following document:

{
  "domain":"https://www.coralogix.com",
  "query_string":"a=b&b=c&c=d",
  "path": "/home",
  "query_string_parameters":{
    "name":"Tom Kosman",
    "b":"c",
    "c":"d"
  }
}

Try it Yourself

Open up your log explore screen, and paste in this dataprime query to see a working example of urlDecode:

create query_string_parameters.name from 'Tom%20Kosman' 
| choose query_string_parameters.name 
| replace query_string_parameters.name with query_string_parameters.name.urlDecode()

Next urlEncode