Can Splunk decompress the payload stored in a database and make it in text format as part of pulling the data?

[amit97ee354]

We have integrated systems from app tier to the Databse where the run-time data (including the payload) at the App tier are stored in the DB. The component which pushes data to the DB is developed by DBA group. That component is compressing the payload data before pushing to the DB. When we connect to the DB, I just see ****binary**** as the payload column data. The application team is asking whether Splunk has a capability to decompress the payload and make it in text format as a part of pulling the data.

Are there any plugins available to perform the following?
o Takes a byte array as input
o Uses the .NET’s DefalateStream to do decompress for the given input array and result is de-compressed byte array
o Convert ‘De-compressed Byte array’ to String
o Returns the String

Appreciate your help and response if you have run into the similar kind of situation and/or have a solution for this problem

[woodcock]

You need to use a scripted input to convert the binary payload to text:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/ScriptedInputsIntro

Once you get that working, to abstract away the guts, make it modular input:

http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/Modinputsintro