Skip to main content
Use the unicode_codepoints_to_string function to convert an array of Unicode code points into a UTF-8 encoded string. This function is helpful when your data represents characters as numeric values—such as integer arrays from encodings, logs, or telemetry fields—and you want to decode them into readable text. You can use unicode_codepoints_to_string to reconstruct log messages, parse encoded payloads, or normalize fragmented character sequences for visualization, comparison, or filtering.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
Splunk SPL doesn’t have a built-in function that directly converts an array of Unicode code points into a string. You typically need to use custom scripts, external commands, or workaround expressions to achieve similar functionality.
| eval decoded=custom_decode_function(codepoints)
ANSI SQL doesn’t define a standard function for converting arrays of Unicode code points into strings. Implementing such functionality typically requires procedural code (e.g., in PL/pgSQL or T-SQL) or custom UDFs.
-- Pseudo-code in PL/pgSQL
SELECT array_to_string(array_agg(chr(code)), '') FROM codepoints;

​
Usage

​
Syntax

unicode_codepoints_to_string(array)

​
Parameters

NameTypeDescription
arraydynamicAn array of integers representing Unicode code points.

​
Returns

A string constructed from the given Unicode code points using UTF-8 encoding.

​
Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Sometimes HTTP logs store user-agent strings or query parameters as numeric arrays for compact storage. You can use unicode_codepoints_to_string to decode those sequences.Query
['sample-http-logs']
| extend codepoints = dynamic([72, 84, 84, 80])
| extend decoded_method = unicode_codepoints_to_string(codepoints)
| project _time, decoded_method
Run in PlaygroundOutput
_timedecoded_method
2025-07-29T14:12:00ZHTTP
This query decodes the static Unicode array [72, 84, 84, 80] into the string 'HTTP'.
  • array_concat: Combines multiple arrays. Useful when merging code point arrays from different strings.
  • array_length: Returns the number of elements in an array. Use it to check how many code points a string contains.
  • parse_path: Parses a path into components. Use it with unicode_codepoints_from_string when decoding or inspecting URL paths.
  • unicode_codepoints_from_string: TODO
⌘I