Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Base64: Parsing an XML file using kv_mode=xml, how to get the Base64 script "recurse" and decode more than the first line?

$
0
0
I'm parsing an XML file using the `kv_mode=xml` in my props.conf and that's all good and well. However, these XMLs that are coming back as a payload from another app are formatted like this: PC11AbBccDlllK[...]AbBccDQQqq[...] In the Search app, the tables format correctly and I get multiple values per host. These values are on separate lines, but not being treated as separate events. I'm fine with that part. The Values are in Base64. I downloaded the base64 app and ran a decode string against the source type and it worked, but only for the first value of every host. Any ideas on how to make the base64 script "recurse" and decode more than the first line?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>