Axiom
Overview

url_encode

Usage#

Syntax#

url_encode(url)

Parameters#

Name Type Required Description
url string Yes The input string to encode for URL transmission.

Returns#

Returns the string with special characters encoded for safe URL transmission.

Use case examples#

Encode log field values for safe inclusion in generated URLs or API calls.

Query

['sample-http-logs']
| extend search_term = 'hello world & special chars'
| extend encoded_search = url_encode(search_term)
| extend api_url = strcat('/api/search?q=', encoded_search)
| project _time, search_term, encoded_search, api_url
| limit 10

Run in Playground

Output

_time search_term encoded_search api_url
2024-11-06T10:00:00Z hello world & special chars hello%20world%20%26%20special%20chars /api/search?q=hello%20world%20%26%20special%20chars

This query encodes search terms for safe use in API URLs, ensuring special characters don't break the URL structure.

Encode service metadata for inclusion in trace URLs or external system integrations.

Query

['otel-demo-traces']
| extend service_info = strcat(['service.name'], ': ', kind)
| extend encoded_info = url_encode(service_info)
| extend trace_url = strcat('https://tracing.example.com/trace/', trace_id, '?service=', encoded_info)
| project _time, service_info, encoded_info, trace_url
| limit 10

Run in Playground

Output

_time service_info encoded_info trace_url
2024-11-06T10:00:00Z frontend: server frontend%3A%20server https://tracing.example.com/trace/abc123?service=frontend%3A%20server

This query encodes service information for safe inclusion in trace viewing URLs, enabling proper link generation in monitoring dashboards.

Encode alert details for safe transmission to webhook endpoints or SIEM systems.

Query

['sample-http-logs']
| extend alert_message = strcat('Security Alert: ', method, ' to ', uri, ' from ', ['geo.country'])
| extend encoded_alert = url_encode(alert_message)
| extend webhook_url = strcat('https://alerts.example.com/webhook?message=', encoded_alert)
| project _time, alert_message, encoded_alert, webhook_url
| limit 10

Run in Playground

Output

_time alert_message encoded_alert webhook_url
2024-11-06T10:00:00Z Security Alert: GET to /admin from United States Security%20Alert%3A%20GET%20to%20%2Fadmin%20from%20United%20States https://alerts.example.com/webhook?message=Security%20Alert%3A%20GET%20to%20%2Fadmin%20from%20United%20States

This query encodes security alert messages for safe transmission via webhooks, ensuring special characters in URIs or messages don't break the webhook URL.

  • url_decode: Decodes URL-encoded strings. Use this to reverse the encoding operation.
  • format_url: Formats URLs from components. Use this for building complete URLs from parts.
  • parse_url: Parses URLs into components. Use this to extract parts before encoding.
  • base64_encode_tostring: Encodes strings as Base64. Use this for Base64 encoding rather than URL encoding.

Other query languages#

Splunk SPL users

In Splunk SPL, you use urlencode. APL's url_encode provides the same functionality.

Splunk example

| eval encoded=urlencode(field)

APL equivalent

['sample-http-logs']
| extend encoded = url_encode(field)
ANSI SQL users

In ANSI SQL, URL encoding varies by database. APL's url_encode provides standardized URL encoding.

SQL example

SELECT URL_ENCODE(field) AS encoded FROM logs;

APL equivalent

['sample-http-logs']
| extend encoded = url_encode(field)

Updated

Was this page helpful?