topic Re: Having a base64 decoding problem in Splunk 9- How to decode Idap-events? in Splunk Search

Having a base64 decoding problem in Splunk 9- How to decode Idap-events?

rrovers — Fri, 17 Mar 2023 15:59:32 GMT

After installing splunk 9 we have a problem with decoding ldap-events. We tried several apps but none of them gave us correct results.

We wanted to use the app "Encode / Decode Data for Splunk" but we can't find any instructions of how to use it.

Does anyone have experience with base64 decoding in splunk 9?

Re: base64 decoding problem in Splunk 9?

rrovers — Fri, 17 Mar 2023 08:51:15 GMT

Answering my own question:

Syntax is like this:

| code field=randombase64field method=base64 action=decode destfield=test

unfortunately it doesn't decode diacritics correctly.

Does someone have a solution for that? Apps that worked fine in splunk 8 don't seem to work correct in splunk 9.

Re: Having a base64 decoding problem in Splunk 9- How to decode Idap-events?

vnarahari — Tue, 09 Jan 2024 17:27:39 GMT

We had the same problem initially and found more details about code command usage under \TA-code\default\searchbnf.conf

We are able to decode the URL or process using | code method=base64 field=encodedcommand action=decode destfield=decoded_command key=abc123 but when we stats the decoded_command it gives the result as "p".

I tried the base64 conversion matrix macro as well, it does the same p thing.

Can anyone help?

Re: Having a base64 decoding problem in Splunk 9- How to decode Idap-events?

rrovers — Wed, 10 Jan 2024 06:42:11 GMT

Later we have used an app named decrypt2 and it worked for us with this syntax:

| decrypt field=randomfield atob emit('randomfielddecrypt')