Archive

XOR decode search results?

tommyc
New Member

Does anyone know a way to XOR results with a given key? By that I mean my search results would have an encoded hex string that I want to decode with, for example, "FF" resulting in the decoded string.

I thought there would be an easy way but i'm not seeing it.

Tags (1)
0 Karma

mjz
Explorer

Yes, you can use the following app - https://splunkbase.splunk.com/app/2655/

Disclaimer: I'm the author.

 

0 Karma

Ayn
Legend

There is no such built-in function or operator. What you can do is build your own command that you can perform XOR on your search results with.

0 Karma

araitz
Splunk Employee
Splunk Employee

Although this is technically 3.x only, this might give you a start: http://splunkbase.splunk.com/apps/Search_Commands/3.x/Technologies/Splunk/app:hexdec

0 Karma