Axiom
Overview

unicode_codepoints_to_string

You can use unicode_codepoints_to_string to reconstruct log messages, parse encoded payloads, or normalize fragmented character sequences for visualization, comparison, or filtering.

Usage#

Syntax#

unicode_codepoints_to_string(array)

Parameters#

Name Type Description
array dynamic An array of integers representing Unicode code points.

Returns#

A string constructed from the given Unicode code points using UTF-8 encoding.

Use case examples#

Sometimes HTTP logs store user-agent strings or query parameters as numeric arrays for compact storage. You can use unicode_codepoints_to_string to decode those sequences.

Query

['sample-http-logs']
| extend codepoints = dynamic([72, 84, 84, 80])
| extend decoded_method = unicode_codepoints_to_string(codepoints)
| project _time, decoded_method

Run in Playground

Output

_time decoded_method
2025-07-29T14:12:00Z HTTP

This query decodes the static Unicode array [72, 84, 84, 80] into the string 'HTTP'.

In tracing systems, service metadata might be emitted as numeric codes for efficiency. You can use unicode_codepoints_to_string to interpret those codes during post-processing.

Query

['otel-demo-traces']
| where ['service.name'] == 'checkout'
| extend trace_label_codepoints = dynamic([67, 72, 69, 67, 75])
| extend decoded_label = unicode_codepoints_to_string(trace_label_codepoints)
| project _time, trace_id, ['service.name'], decoded_label

Run in Playground

Output

_time trace_id ['service.name'] decoded_label
2025-07-29T14:20:00Z d4e9aefb8cc31b4d checkout CHECK

The query decodes a fixed array into the label 'CHECK' to tag traces visually in dashboards.

Sometimes security tools emit obfuscated payloads as numeric arrays. You can decode and inspect them using unicode_codepoints_to_string.

Query

['sample-http-logs']
| extend obfuscated_uri = dynamic([47, 108, 111, 103, 105, 110])
| extend decoded_uri = unicode_codepoints_to_string(obfuscated_uri)
| project _time, uri, decoded_uri

Run in Playground

Output

_time uri decoded_uri
2025-07-29T14:30:00Z /blocked /login

This example shows how to reconstruct a denied URI (/login) from its obfuscated form using code points.

  • array_concat: Combines multiple arrays. Useful when merging code point arrays from different strings.
  • array_length: Returns the number of elements in an array. Use it to check how many code points a string contains.
  • parse_path: Parses a path into components. Use it with unicode_codepoints_from_string when decoding or inspecting URL paths.
  • unicode_codepoints_from_string: Converts a UTF-8 string into an array of Unicode code points.

Other query languages#

Splunk SPL users

Splunk SPL doesn’t have a built-in function that directly converts an array of Unicode code points into a string. You typically need to use custom scripts, external commands, or workaround expressions to achieve similar functionality.

Splunk example

| eval decoded=custom_decode_function(codepoints)

APL equivalent

print decoded = unicode_codepoints_to_string(dynamic([72, 101, 108, 108, 111]))
ANSI SQL users

ANSI SQL doesn’t define a standard function for converting arrays of Unicode code points into strings. Implementing such functionality typically requires procedural code (e.g., in PL/pgSQL or T-SQL) or custom UDFs.

SQL example

-- Pseudo-code in PL/pgSQL
SELECT array_to_string(array_agg(chr(code)), '') FROM codepoints;

APL equivalent

print decoded = unicode_codepoints_to_string(dynamic([72, 101, 108, 108, 111]))

Updated

Was this page helpful?