All Apps and Add-ons

indexing decoded value or calculating field via eval for indexing.

rgonzale6
Path Finder

we're doing minor obfuscation of a field within our incoming UDP plaintext events - is there any way to decode prior to indexing so the output is searchable? Is the base64 function available for an eval for a calculated field?

Tags (1)
0 Karma

Ayn
Legend

You can't do the decoding at index-time - you'd either have to make sure the value is decoded by the time it reaches Splunk by having something else receive the data and decode it before passing it on, or perform the decoding at search-time. Base64 decoding works just fine at search-time on any field regardless of how it was created.

0 Karma

Ayn
Legend

Just throw a search statement after the decode command.

... | base64 action=decode yourfield | search yourfield=...
0 Karma

rgonzale6
Path Finder

decoding is definitely working in terms of reporting - the issue is, I need to search against the decoded data and I cannot.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...