topic Re: Converting strings in Splunk Search

Converting strings

mborner — Wed, 16 Feb 2011 16:05:20 GMT

I've got email subjects extracted into a field, which are encoded in UTF-8 or ISO-8859-*

Examples:

=?ISO-8859-15?Q?Video:_Hei=DFes_Photo-Shooting_Miley_Cyrus!_?= =?ISO-8859-15?Q?Olala!?=

=?UTF-8?Q?Tr:_La_beaut=C3=A9...?=

What would be the best way to convert these into a readable format?

Re: Converting strings

Ron_Naken — Thu, 17 Feb 2011 02:21:14 GMT

You can configure character set encoding. Here is the manual page that describes how: http://www.splunk.com/base/Documentation/4.1.7/Admin/Configurecharactersetencoding

Re: Converting strings

mborner — Wed, 29 Jun 2011 12:21:02 GMT

It was not exactly was I was looking for. The logfile is in ASCII, but it contains fields that are MIME encoded.

To solve the problem I wrote an external command, that decodes MIME fields into utf-8.

Get the code here:

http://pastebin.com/vtWnL50z

Re: Converting strings

landen99 — Fri, 04 Apr 2014 20:10:49 GMT

Let's say that we want to create a field which is simply an original field decoded into ASCII and we want that process to happen internally within Splunk. How do we do that?

Re: Converting strings

tomasmoser — Wed, 07 Oct 2020 22:03:11 GMT

Try MIME Decoder TA add-on:
https://splunkbase.splunk.com/app/5116/