Forum Discussion
Unable to decode base64 value - Kusto
Hi,
I need your assistance please.
I have the following query:
F5_CL
| where TimeGenerated >= ago(3m) //change to required time
| extend RawData=split(RawData, '##') //split all raw data to specific values
|extend base64Value = tostring(RawData[24]) // base64 value
In the base64value there is base 64 value.
I don't know how to decode this value with extend!
I want that each parameter inside of this value will be separated.
Will appreciate your support please.
Thanks!
- There are a few operators to decode, for strings
F5_CL
| where TimeGenerated >= ago(3m) //change to required time
| extend RawData=split(RawData, '##') //split all raw data to specific values
| extend base64Value = base64_decode_tostring(RawData) // base64 value- When I send the following Query:
F5_CL
| where TimeGenerated >= ago(7h) //change to required time
| extend RawData=split(RawData, '##') //split all raw data to specific values
| extend base64Value = base64_decode_tostring(RawData[24]) // base64 value
I get the following error:
"base64_decodestring(): argument #1 was not of an expected data type: string"
When I check RawData[24] using gettype() function, the result is String.
Why I get this error?- Could you post an example of your data to make it easier?
