Splunk Search

How to convert _raw with encoded chars (not detected as string) into a readable string?

denissotoacc
Path Finder

I have the following _raw field in my index:

_raw

Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}


So, I realized ' = '. But there is no way to convert that string into a human readable string, like this:

Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}

I tried with something like this, without sucess:

 

| eval myfield = replace(tostring(_raw),"x27","'")

 

 

Then I checked if the string contains "x27" and turns out it is not being detected:

 

| eval exists=if(like(tostring(_raw), "%x27%"), "YES", "NO")

 

denissotoacc_0-1653066268220.png

Is there a way to convert that weird string into a human readable string?

 

Labels (2)
Tags (2)
0 Karma

somesoni2
Revered Legend

Give this a try (run anywhere sample, replace everything before eval with your search)

| makeresults | eval _raw="Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}" | eval _raw=replace(_raw,"\&#x27\;","'")

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this help?

| eval decoded=replace(_raw,"'","'")
0 Karma

denissotoacc
Path Finder

Already tried, no success. It would work if the _raw field is recognized as string, but it is not. I've already tried "tostring(_raw)" also. Nothing changes

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...