Splunk Search

How to convert _raw with encoded chars (not detected as string) into a readable string?

denissotoacc
Path Finder

I have the following _raw field in my index:

_raw

Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}


So, I realized ' = '. But there is no way to convert that string into a human readable string, like this:

Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}

I tried with something like this, without sucess:

 

| eval myfield = replace(tostring(_raw),"x27","'")

 

 

Then I checked if the string contains "x27" and turns out it is not being detected:

 

| eval exists=if(like(tostring(_raw), "%x27%"), "YES", "NO")

 

denissotoacc_0-1653066268220.png

Is there a way to convert that weird string into a human readable string?

 

Labels (2)
Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try (run anywhere sample, replace everything before eval with your search)

| makeresults | eval _raw="Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}" | eval _raw=replace(_raw,"\&#x27\;","'")

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this help?

| eval decoded=replace(_raw,"'","'")
0 Karma

denissotoacc
Path Finder

Already tried, no success. It would work if the _raw field is recognized as string, but it is not. I've already tried "tostring(_raw)" also. Nothing changes

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...