About vnarahari

vnarahari · ‎04-03-2024

@ITWhisperer Thanks for your response, It's not multivalued field and tried regex which isn't excluding the results as well.

vnarahari · ‎04-02-2024

I have been working on decoding a base64 encoded command using the decrypt2 app. I have successfully decoded the string but facing difficulty excluding or searching and also running stats of decoded field which gives a "p" thing as a result. Examples of | Search NOT: Example of Stats resulted "p": | rex field="process" ".*-(e|E)(n|N)[codemanCODEMAN]{0,12}\ (?<process_enc>[A-Za-z\d+/=]*)?" | decrypt field=process_enc b64 emit('process_decoded') | stats count by process_decoded Could someone please provide guidance on the correct syntax to exclude or search the decoded field using search not or using a lookup and help clarify the "P" thing from stats command? DECRYPT2

vnarahari · ‎01-09-2024

We had the same problem initially and found more details about code command usage under \TA-code\default\searchbnf.conf We are able to decode the URL or process using | code method=base64 field=encodedcommand action=decode destfield=decoded_command key=abc123 but when we stats the decoded_command it gives the result as "p". I tried the base64 conversion matrix macro as well, it does the same p thing. Can anyone help?

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-29-2019

Online Status	Offline
Date Last Visited	‎05-21-2024 02:21 PM

Issue with excluding a decoded base64 command

Re: Issue with excluding a decoded base64 command

Issue with excluding a decoded base64 command

Re: Having a base64 decoding problem in Splunk 9- ...