The base64_encode_tostring function encodes a string into Base64 format. Use this function when you need to encode data for transmission or storage in systems that only support text-based formats, such as APIs, configuration files, or log analysis pipelines.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you might not have a built-in Base64 encoding function and would typically rely on external scripts or commands. In APL, base64_encode_tostring provides native Base64 encoding directly in your queries.
['sample-http-logs']
| extend encoded = base64_encode_tostring(field_name)In ANSI SQL, Base64 encoding typically requires database-specific functions like TO_BASE64() in MySQL or custom functions. APL provides base64_encode_tostring as a standard function.
['sample-http-logs']
| extend encoded = base64_encode_tostring(field_name)Usage
Syntax
base64_encode_tostring(value)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| value | string | Yes | The input string to be encoded as Base64. |
Returns
Returns the input string encoded as a Base64 string.
Use case examples
Encode HTTP content types for secure transmission or storage in Base64 format.
Query
['sample-http-logs']
| extend encoded_content_type = base64_encode_tostring(content_type)
| project _time, content_type, encoded_content_type
| limit 10Output
| _time | content_type | encoded_content_type |
|---|---|---|
| 2024-11-06T10:00:00Z | application/json | YXBwbGljYXRpb24vanNvbg== |
| 2024-11-06T10:01:00Z | text/html | dGV4dC9odG1s |
This query encodes the content type of each HTTP request into Base64 format, which is useful when you need to pass content types through systems that have character restrictions.
Encode service names in traces for compatibility with external systems.
Query
['otel-demo-traces']
| extend encoded_service = base64_encode_tostring(['service.name'])
| project _time, ['service.name'], encoded_service, trace_id
| limit 10Output
| _time | service.name | encoded_service | trace_id |
|---|---|---|---|
| 2024-11-06T10:00:00Z | frontend | ZnJvbnRlbmQ= | abc123 |
| 2024-11-06T10:01:00Z | checkout | Y2hlY2tvdXQ= | def456 |
This query encodes service names into Base64 format, which can be useful when transmitting trace metadata to systems with specific encoding requirements.
Encode user IDs or sensitive identifiers in security logs for obfuscation or transmission.
Query
['sample-http-logs']
| extend encoded_id = base64_encode_tostring(id)
| project _time, id, encoded_id, status, uri
| limit 10Output
| _time | id | encoded_id | status | uri |
|---|---|---|---|---|
| 2024-11-06T10:00:00Z | user123 | dXNlcjEyMw== | 401 | /api/login |
| 2024-11-06T10:01:00Z | user456 | dXNlcjQ1Ng== | 403 | /admin |
This query encodes user IDs from failed authentication attempts into Base64 format, which can be useful for secure log transmission or when integrating with systems that require encoded identifiers.
List of related functions
- base64_decode_tostring: Decodes a Base64-encoded string back to its original UTF-8 format. Use this when you need to reverse the encoding operation.
- base64_encode_fromarray: Encodes an array of bytes into a Base64 string. Use this when working with binary data rather than text strings.
- base64_decode_toarray: Decodes a Base64 string into an array of bytes. Use this when you need to work with the raw binary representation.
- url_encode: Encodes a URL string for safe transmission. Use this when working with URLs rather than general text encoding.