Base64
Overview
Details
The base64 custom search command is a command that do Base64 encoding and decoding.
... | base64 field=your_field [action=(encode|decode)] [mode=(replace|append)] [suppress_error=(True|False)]
field: field to encode or decode.action:encode(default) ordecodethe content. Optional.mode:replacethe existing field content (default) or create a new field namedbase64(modeappend). Optional.suppress_error: do not raise errors if set toTrue. Optional, default toFalse.
Note on decoding:
While the input string can be anything for the encoding operation, it should respect the alphabet [a-zA-Z0-9/=] and its length should be a multiple of 4 while decoding. If the format is not respected, the command will throw errors (except if you set the flag suppress_error).
In the following example, we assume we are working on proxy/web logs and those will contains a field uri. This field will contains URI links and some of them will contains
an argument plop which refer to Base64 encoded data.
So, to get it working:
- filter the results
- extract the base64 content (command
rex) - evaluate the length of the base64 content to avoid content with a wrong padding
- decode the base64 content
Here is one way of doing it in Splunk:
... your search to get field 'uri' for example...
| fields uri
| rex field=uri "plop=(?<content_to_decode>[a-zA-Z0-9/=]*)”
| eval clength=len(content_to_decode)%4
| search clength=0
| base64 field=“content_to_decode" action=“decode" mode=“append"
History
v2.0
- Avoid errors by adding padding
- Less ambiguous escaped output
- Optional charset when decoding
- Lookups with default options
- Return original event if input field does not exist
- MIME decoding for base64 encoded MIME
- Workaround for leading spaces
v1.1
- non printable characters are presented as hexadecimal when decoding (ex: base64=<%PDF\x00\x00).
v1.0
- Initial release