Splunk Search

"Q" Encoding

olivier_ma
Explorer

Hello,

I have a field which contains values encoded in "Q" (I just discovered this encoding type : RFC 1522). It seems to be used a lot in email logs.

I wasn't able to find any commands that helps to convert to a 'readable' string.

Any help, idea, suggestion would be appreciated in order to convert these values (by Splunk commands or by fields extractions processs).

0 Karma
1 Solution

knielsen
Contributor

Hi,

I took a little stupid test message "Why is a Q encoded string (random text <>)?", tried an online Q encoder to encode this to "Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" and could decode this in Splunk with 2 rex commands:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | rex field=input mode=sed "s/=(..)/%\1/g" | rex field=input mode=sed "s/_/ /g" | eval output=urldecode(input)

Not sure if this covers the whole spec, test it out with your real data.

Hth,
-Kai.

edit: actually, this looks much nicer:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | eval output=urldecode(replace(replace(input,"=","%"),"_","%20"))

View solution in original post

ddrillic
Ultra Champion

An oldie one ; - )

alt text

0 Karma

ddrillic
Ultra Champion

Can you please give us an example of these "Q" values? maybe a snapshot...

0 Karma

knielsen
Contributor

Hi,

I took a little stupid test message "Why is a Q encoded string (random text <>)?", tried an online Q encoder to encode this to "Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" and could decode this in Splunk with 2 rex commands:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | rex field=input mode=sed "s/=(..)/%\1/g" | rex field=input mode=sed "s/_/ /g" | eval output=urldecode(input)

Not sure if this covers the whole spec, test it out with your real data.

Hth,
-Kai.

edit: actually, this looks much nicer:

| makeresults | eval input="Why_is_a_Q_encoded_string_=28random_text_=3C=3E=29=3F" | eval output=urldecode(replace(replace(input,"=","%"),"_","%20"))

View solution in original post

olivier_ma
Explorer

Perfect, exactly what I'm looking for :). Indeed use urldecode is much easier.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!