Getting Data In

Eval and rex to props.comf

Splunk_rocks
Path Finder

Just looking some help to construct props file for below search statement.

| rex max_match=10 field=violation_details "(?[^<]+)" | base64 field=cookie_value action=decode |

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

The rex part you can do with a REPORT and a MV_ADD = true in the transforms I think, however the base64 command is another question, as you can't call commands in props/transforms.

I think you would either have to still have the base64 in your search, or thinking outside of the box a bit:
You could implement a base64 lookup as an external script lookup, although I don't know what the limits are of the size that you can input (i.e. this probably won't work for big base64 blobs)

0 Karma

Splunk_rocks
Path Finder

Thanks for the update, thats what i feel but just thought of double check

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Are you trying to get the base64 encoded field decoded through the props.confconfiguration? If so, this can't be done, there is no method of doing the decoding within the props.conf file. You can extract the field, but it will be in the encoded state, not decoded.

0 Karma

Splunk_rocks
Path Finder

| rex max_match=10 field=violation_details "(?[^<]+)" | base64 field=cookie_value action=decode |

0 Karma

Splunk_rocks
Path Finder

missing filed info so pasted here ..Looks like field=violation_details ""(?)

0 Karma

FrankVl
Ultra Champion

put your search code in as code (use the 101010 button, or surround with ```).

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...