parse_urlquery

This page explains how to use the parse_urlquery function in APL.

The parse_urlquery function parses a URL query string and returns a dynamic object containing the query parameters as key-value pairs. Use this function to extract and analyze query parameters from URLs in logs, API requests, or web traffic data.

Usage

Syntax

APL

parse_urlquery(query_string)

Parameters

Name	Type	Required	Description
query_string	string	Yes	A URL query string (with or without the leading '?') to parse.

Returns

Returns a dynamic object containing the query parameters as key-value pairs.

Use case examples

Extract and analyze query parameters from API requests to understand search patterns and filter usage.

Query

APLRun in Playground

['sample-http-logs']
| extend parameters = parse_urlquery('page=1&limitation=50&sort=date')
| extend page = toint(parameters.page)
| extend limitation = toint(parameters.limitation)
| extend sort = tostring(parameters.sort)
| summarize request_count = count() by page, limitation, sort
| sort by request_count desc
| limit 10

Output

page	limit	sort	request_count
1	50	date	8765

This query parses query parameters from API requests to analyze pagination and sorting preferences.

Extract query parameters from HTTP spans to analyze API query patterns.

Query

APLRun in Playground

['otel-demo-traces']
| extend query_string = '?user_id=12345&action=checkout&currency=USD'
| extend params = parse_urlquery(query_string)
| extend user_id = tostring(params.user_id)
| extend action = tostring(params.action)
| extend currency = tostring(params.currency)
| summarize span_count = count() by action, currency
| sort by span_count desc
| limit 10

Output

action	currency	span_count
checkout	USD	8765

This query extracts query parameters from span data to analyze user actions and currency usage patterns in a distributed system.

Detect potential SQL injection or XSS attacks by analyzing suspicious query parameters.

Query

APLRun in Playground

['sample-http-logs']
| extend query_params = parse_urlquery('search=&lt;script&gt;&id=1 OR 1=1')
| extend search_param = tostring(query_params.search)
| extend id_param = tostring(query_params.id)
| extend has_script = indexof(search_param, '&lt;script&gt;') >= 0
| extend has_sql = indexof(id_param, 'OR') >= 0
| where has_script or has_sql
| project _time, uri, search_param, id_param, has_script, has_sql, id, ['geo.country']
| limit 10

Output

_time	uri	search_param	id_param	has_script	has_sql	id	geo.country
2024-11-06T10:00:00Z	/search	<script>	1 OR 1=1	true	true	user123	Unknown

This query parses query parameters from failed requests and checks for injection attack patterns, helping identify potential security threats.

parse_url: Parses complete URLs into all components. Use this when you need more than just query parameters.
url_decode: Decodes URL-encoded strings. Use this to decode individual query parameter values.
split: Splits strings by delimiters. Use this for simpler query string tokenization without key-value parsing.
parse_json: Parses JSON strings. Use this when working with JSON data rather than URL query strings.

parse_urlquery

Usage

Syntax

Parameters

Returns

Use case examples

List of related functions

Other query languages