"Q" Encoding

[olivier_ma]

Hello,

I have a field which contains values encoded in "Q" (I just discovered this encoding type : RFC 1522). It seems to be used a lot in email logs.

I wasn't able to find any commands that helps to convert to a 'readable' string.

Any help, idea, suggestion would be appreciated in order to convert these values (by Splunk commands or by fields extractions processs).

[ddrillic]

An oldie one ; - )

[ddrillic]

Can you please give us an example of these "Q" values? maybe a snapshot...

[knielsen · Accepted solution]

Hi,

I took a little stupid test message "Why is a Q encoded string (random text <>)?", tried an online Q encoder to encode this to "Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" and could decode this in Splunk with 2 rex commands:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | rex field=input mode=sed "s/=(..)/%\1/g" | rex field=input mode=sed "s/_/ /g" | eval output=urldecode(input)

Not sure if this covers the whole spec, test it out with your real data.

Hth,
-Kai.

edit: actually, this looks much nicer:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | eval output=urldecode(replace(replace(input,"=","%"),"_","%20"))

[olivier_ma]

Perfect, exactly what I'm looking for :). Indeed use urldecode is much easier.