Stay organized with collections
Save and categorize content based on your preferences.
strings.extract_url_params(url_string)
Description
Extracts the URL query parameters from a URL string and adds it to an array.
Param data types
STRING
Return type
ARRAY_STRINGS
Code samples
Example 1
The following example extracts the query parameter (name) from the URL.
strings.extract_url_params("https://example.com/?name=Johnathan%20Smith") // yields this array of strings ["name:Johnathan Smith"]
Example 2
The following example yields an empty array as there are no query parameters in the URL.
strings.extract_url_params("https://example.com/") // yields an empty array []
Example 3
The following example extracts the query parameter (foo) from the URL.
strings.extract_url_params(" \t !$5*^)&dahgsdfs;http://www.google.com/?foo=bar") // yields this array of strings ["foo:bar"]
Example 4
This example shows handling of URIs.
strings.extract_url_params("mailto:?to=&subject=&body=") // yields an empty array []
Example 5
This example shows handling of non-ASCII characters.
strings.extract_url_params("http://例子/?卷筒纸=中国") // yields this array of strings ["卷筒纸:中国"]
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-07-14 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-14 UTC."],[[["\u003cp\u003e\u003ccode\u003estrings.extract_url_params\u003c/code\u003e is a function that extracts URL query parameters from a given URL string.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns an array of strings, where each string represents a query parameter and its value (e.g., "name:Johnathan Smith").\u003c/p\u003e\n"],["\u003cp\u003eIf a URL does not contain any query parameters, the function returns an empty array.\u003c/p\u003e\n"],["\u003cp\u003eThe function can handle URLs with non-ASCII characters in their query parameters.\u003c/p\u003e\n"],["\u003cp\u003eThe function is supported in Rules and Search.\u003c/p\u003e\n"]]],[],null,["### strings.extract_url_params\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.extract_url_params(url_string)\n\n#### Description\n\nExtracts the URL query parameters from a URL string and adds it to an array.\n\n#### Param data types\n\n`STRING`\n\n#### Return type\n\n`ARRAY_STRINGS`\n\n#### Code samples\n\n##### Example 1\n\nThe following example extracts the query parameter (`name`) from the URL. \n\n strings.extract_url_params(\"https://example.com/?name=Johnathan%20Smith\") // yields this array of strings [\"name:Johnathan Smith\"]\n\n##### Example 2\n\nThe following example yields an empty array as there are no query parameters in the URL. \n\n strings.extract_url_params(\"https://example.com/\") // yields an empty array []\n\n##### Example 3\n\nThe following example extracts the query parameter (`foo`) from the URL. \n\n strings.extract_url_params(\" \\t !$5*^)&dahgsdfs;http://www.google.com/?foo=bar\") // yields this array of strings [\"foo:bar\"]\n\n##### Example 4\n\nThis example shows handling of URIs. \n\n strings.extract_url_params(\"mailto:?to=&subject=&body=\") // yields an empty array []\n\n##### Example 5\n\nThis example shows handling of non-ASCII characters. \n\n strings.extract_url_params(\"http://例子/?卷筒纸=中国\") // yields this array of strings [\"卷筒纸:中国\"]"]]
