The url_encode function converts a string into a format that can be safely transmitted over the Internet by encoding special characters. Use this function to prepare strings for URLs, build query parameters, or ensure data integrity in web requests.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use urlencode. APL's url_encode provides the same functionality.
['sample-http-logs']
| extend encoded = url_encode(field)In ANSI SQL, URL encoding varies by database. APL's url_encode provides standardized URL encoding.
['sample-http-logs']
| extend encoded = url_encode(field)Usage
Syntax
url_encode(url)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| url | string | Yes | The input string to encode for URL transmission. |
Returns
Returns the string with special characters encoded for safe URL transmission.
Use case examples
Encode log field values for safe inclusion in generated URLs or API calls.
Query
['sample-http-logs']
| extend search_term = 'hello world & special chars'
| extend encoded_search = url_encode(search_term)
| extend api_url = strcat('/api/search?q=', encoded_search)
| project _time, search_term, encoded_search, api_url
| limit 10Output
| _time | search_term | encoded_search | api_url |
|---|---|---|---|
| 2024-11-06T10:00:00Z | hello world & special chars | hello%20world%20%26%20special%20chars | /api/search?q=hello%20world%20%26%20special%20chars |
This query encodes search terms for safe use in API URLs, ensuring special characters don't break the URL structure.
Encode service metadata for inclusion in trace URLs or external system integrations.
Query
['otel-demo-traces']
| extend service_info = strcat(['service.name'], ': ', kind)
| extend encoded_info = url_encode(service_info)
| extend trace_url = strcat('https://tracing.example.com/trace/', trace_id, '?service=', encoded_info)
| project _time, service_info, encoded_info, trace_url
| limit 10Output
| _time | service_info | encoded_info | trace_url |
|---|---|---|---|
| 2024-11-06T10:00:00Z | frontend: server | frontend%3A%20server | https://tracing.example.com/trace/abc123?service=frontend%3A%20server |
This query encodes service information for safe inclusion in trace viewing URLs, enabling proper link generation in monitoring dashboards.
Encode alert details for safe transmission to webhook endpoints or SIEM systems.
Query
['sample-http-logs']
| extend alert_message = strcat('Security Alert: ', method, ' to ', uri, ' from ', ['geo.country'])
| extend encoded_alert = url_encode(alert_message)
| extend webhook_url = strcat('https://alerts.example.com/webhook?message=', encoded_alert)
| project _time, alert_message, encoded_alert, webhook_url
| limit 10Output
| _time | alert_message | encoded_alert | webhook_url |
|---|---|---|---|
| 2024-11-06T10:00:00Z | Security Alert: GET to /admin from United States | Security%20Alert%3A%20GET%20to%20%2Fadmin%20from%20United%20States | https://alerts.example.com/webhook?message=Security%20Alert%3A%20GET%20to%20%2Fadmin%20from%20United%20States |
This query encodes security alert messages for safe transmission via webhooks, ensuring special characters in URIs or messages don't break the webhook URL.
List of related functions
- url_decode: Decodes URL-encoded strings. Use this to reverse the encoding operation.
- format_url: Formats URLs from components. Use this for building complete URLs from parts.
- parse_url: Parses URLs into components. Use this to extract parts before encoding.
- base64_encode_tostring: Encodes strings as Base64. Use this for Base64 encoding rather than URL encoding.