All Apps and Add-ons

Can Splunk decompress the payload stored in a database and make it in text format as part of pulling the data?


We have integrated systems from app tier to the Databse where the run-time data (including the payload) at the App tier are stored in the DB. The component which pushes data to the DB is developed by DBA group. That component is compressing the payload data before pushing to the DB. When we connect to the DB, I just see ****binary**** as the payload column data. The application team is asking whether Splunk has a capability to decompress the payload and make it in text format as a part of pulling the data.

Are there any plugins available to perform the following?
o Takes a byte array as input
o Uses the .NET’s DefalateStream to do decompress for the given input array and result is de-compressed byte array
o Convert ‘De-compressed Byte array’ to String
o Returns the String

Appreciate your help and response if you have run into the similar kind of situation and/or have a solution for this problem

0 Karma

Esteemed Legend

You need to use a scripted input to convert the binary payload to text:

Once you get that working, to abstract away the guts, make it modular input:

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...