All Apps and Add-ons

I'd like to search on the decode output from the base64 command; could someone point me in that direction

rgaleone1
Path Finder

I am decoding fields and appending or replacing them in events. I would like to search on the newly appended or replaced values, but I am having difficulty forming the search. Has anyone gotten this to work? An example would be excellent.

Tags (3)
0 Karma

cleroux_splunk
Splunk Employee
Splunk Employee

That should help:

source="/tmp/tmp.log" | base64 field="secret" action="decode" | search secret="*127.0.0.1*"

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.