topic Re: XOR decode search results? in Splunk Search

XOR decode search results?

tommyc — Fri, 02 Sep 2011 22:50:17 GMT

Does anyone know a way to XOR results with a given key? By that I mean my search results would have an encoded hex string that I want to decode with, for example, "FF" resulting in the decoded string.

I thought there would be an easy way but i'm not seeing it.

Re: XOR decode search results?

Ayn — Sat, 03 Sep 2011 17:12:02 GMT

There is no such built-in function or operator. What you can do is build your own command that you can perform XOR on your search results with.

Re: XOR decode search results?

araitz — Sun, 04 Sep 2011 19:04:37 GMT

Although this is technically 3.x only, this might give you a start: http://splunkbase.splunk.com/apps/Search_Commands/3.x/Technologies/Splunk/app:hexdec

Re: XOR decode search results?

mjz — Mon, 02 Nov 2020 23:38:17 GMT

Yes, you can use the following app - https://splunkbase.splunk.com/app/2655/

Disclaimer: I'm the author.