topic "Q" Encoding in Splunk Search

"Q" Encoding

olivier_ma — Tue, 29 Aug 2017 08:21:58 GMT

Hello,

I have a field which contains values encoded in "Q" (I just discovered this encoding type : RFC 1522). It seems to be used a lot in email logs.

I wasn't able to find any commands that helps to convert to a 'readable' string.

Any help, idea, suggestion would be appreciated in order to convert these values (by Splunk commands or by fields extractions processs).

Re: "Q" Encoding

knielsen — Tue, 29 Sep 2020 15:31:34 GMT

Hi,

I took a little stupid test message "Why is a Q encoded string (random text <>)?", tried an online Q encoder to encode this to "Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" and could decode this in Splunk with 2 rex commands:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | rex field=input mode=sed "s/=(..)/%\1/g" | rex field=input mode=sed "s/_/ /g" | eval output=urldecode(input)

Not sure if this covers the whole spec, test it out with your real data.

Hth,
-Kai.

edit: actually, this looks much nicer:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | eval output=urldecode(replace(replace(input,"=","%"),"_","%20"))

Re: "Q" Encoding

ddrillic — Tue, 29 Aug 2017 13:56:12 GMT

Can you please give us an example of these "Q" values? maybe a snapshot...

Re: "Q" Encoding

ddrillic — Tue, 29 Aug 2017 14:44:06 GMT

An oldie one ; - )

Re: "Q" Encoding

olivier_ma — Wed, 30 Aug 2017 08:11:51 GMT

Perfect, exactly what I'm looking for :). Indeed use urldecode is much easier.