How to convert _raw with encoded chars (not detected as string) into a readable string?

[denissotoacc]

I have the following _raw field in my index:

_raw

Response Headers: {'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}

So, I realized ' = '. But there is no way to convert that string into a human readable string, like this:

Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}

I tried with something like this, without sucess:

| eval myfield = replace(tostring(_raw),"x27","'")

Then I checked if the string contains "x27" and turns out it is not being detected:

| eval exists=if(like(tostring(_raw), "%x27%"), "YES", "NO")

Is there a way to convert that weird string into a human readable string?

[somesoni2]

Give this a try (run anywhere sample, replace everything before eval with your search)

| makeresults | eval _raw="Response Headers:

{'Date': 'Fri, 13 May 2022 02:59:34 GMT', 'Content-Type': 'application/json; charset=utf-8'}" | eval _raw=replace(_raw,"\&#x27\;","'")

[ITWhisperer]

Does this help?

| eval decoded=replace(_raw,"'","'")

[denissotoacc]

Already tried, no success. It would work if the _raw field is recognized as string, but it is not. I've already tried "tostring(_raw)" also. Nothing changes