Please see URL that I am referring to: http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Replace
I am trying to utilize a log that has url values that have been percent encoded. I want to replace these encoding characters with their decoded meanings. Example: We%20alerted%20our%20team%20to%20the%20issue.%20We%20apologize%20for%20this%20inconvenience.%20Please%20try%20again%20later.
Based on the above link's examples, I tried the following:
| replace "%20" with " " in errorMessage | top errorMessage
The search runs but I still have these characters in my errorMessage field. Eventually I'll want something like this:
| replace "%20" with " ", "%2C" with ",", "%27" with "'" in field1 field2 field3
What am I doing wrong?