All Apps and Add-ons

indexing decoded value or calculating field via eval for indexing.

rgonzale6
Path Finder

we're doing minor obfuscation of a field within our incoming UDP plaintext events - is there any way to decode prior to indexing so the output is searchable? Is the base64 function available for an eval for a calculated field?

Tags (1)
0 Karma

Ayn
Legend

You can't do the decoding at index-time - you'd either have to make sure the value is decoded by the time it reaches Splunk by having something else receive the data and decode it before passing it on, or perform the decoding at search-time. Base64 decoding works just fine at search-time on any field regardless of how it was created.

0 Karma

Ayn
Legend

Just throw a search statement after the decode command.

... | base64 action=decode yourfield | search yourfield=...
0 Karma

rgonzale6
Path Finder

decoding is definitely working in terms of reporting - the issue is, I need to search against the decoded data and I cannot.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...