URL-decodes the contents of a string field.

ParameterTypeRequiredDefaultDescription
asstringfalse_urldecodeName of output field.
fieldstringtrue The name of the input field with the value to url-decode. [a]

[a] When you provide only one parameter, the implied parameter is field

Examples

With an event with a field Bar=https%3A%2F%2Fwww.humio.com, you get https://www.humio.com in the _urldecode field:

logscale
urlDecode("Bar")

With an event with a field Bar=https%3A%2F%2Fwww.humio.com, you get https://www.humio.com in the Foo field:

logscale
Foo:=urlDecode("Bar")

With an event with a field Bar=https%3A%2F%2Fwww.humio.com, you get https://www.humio.com in the Foo field:

logscale
urlDecode("Bar", as="Foo")