All Apps and Add-ons

indexing decoded value or calculating field via eval for indexing.

rgonzale6
Path Finder

we're doing minor obfuscation of a field within our incoming UDP plaintext events - is there any way to decode prior to indexing so the output is searchable? Is the base64 function available for an eval for a calculated field?

Tags (1)
0 Karma

Ayn
Legend

You can't do the decoding at index-time - you'd either have to make sure the value is decoded by the time it reaches Splunk by having something else receive the data and decode it before passing it on, or perform the decoding at search-time. Base64 decoding works just fine at search-time on any field regardless of how it was created.

0 Karma

Ayn
Legend

Just throw a search statement after the decode command.

... | base64 action=decode yourfield | search yourfield=...
0 Karma

rgonzale6
Path Finder

decoding is definitely working in terms of reporting - the issue is, I need to search against the decoded data and I cannot.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...