convert_to_base_64 ↗

Use the convert_to_base_64() function to encode an input string into its base64 representation.

Syntax

convert_to_base_64 ("<input_string>")

Parameters

Name Type Required Description
input_string string Yes The string to be base64 encoded.

Returns

The convert_to_base_64() function returns the base64-encoded value as a string.

Usage notes

  • The function requires a single string input.
  • The function will return NULL if the input is NULL.
  • This function is typically employed within the alter stage to create new fields or modify existing ones by encoding string data.
  • The function can also be used within a filter stage if the encoding result is needed for a conditional check.

Examples

Example 1: Encoding a basic literal string

Goal: Encode a simple literal string to its base64 representation.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter encoded_string = convert_to_base_64("Hello world")
| fields event_id, encoded_string
| limit 3

Explanation: This query adds a new field, encoded_string, which contains the base64-encoded representation of "Hello world".

Output:

EVENT_ID ENCODED_STRING
101 SGVsbG8gd29ybGQ=
102 SGVsbG8gd29ybGQ=
103 SGVsbG8gd29ybGQ=

Example 2: Encoding an existing string field

Goal: Encode values from an existing string field in the dataset.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter encoded_description = convert_to_base_64(event_description)
| fields event_id, event_description, encoded_description
| limit 3

Explanation: The query creates encoded_description by applying base64 encoding to the event_description field for each record.

Output:

EVENT_ID EVENT_DESCRIPTION ENCODED_DESCRIPTION
101 User login successful VXNlciBsb2dpbiBzdWNjZXNzZnVs
102 File access attempt RmlsZSBhY2Nlc3MgYXR0ZW1wdA==
103 Network connection established TmV0d29yayBjb25uZWN0aW9uIGVzdGFibGlzaGVk

Example 3: Encoding a string derived from a numeric field

Goal: Convert a numeric field to a string and then encode it to base64.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter event_id_string = to_string(event_id)
| alter encoded_id = convert_to_base_64(event_id_string)
| fields event_id, event_id_string, encoded_id
| limit 3

Explanation: The event_id is first converted to a string using to_string(), and then convert_to_base_64() encodes this string.

Output:

EVENT_ID EVENT_ID_STRING ENCODED_ID
101 101 MTAx
102 102 MTAy
103 103 MTAz

Example 4: Encoding an empty string

Goal: Encode an empty string to observe the result.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter encoded_empty_string = convert_to_base_64("")
| fields event_id, encoded_empty_string
| limit 3

Explanation: Encoding an empty string results in an empty string.

Output:

EVENT_ID ENCODED_EMPTY_STRING
101  
102  
103  

Example 5: Handling NULL input

Goal: Observe the behavior when a NULL input is provided to the function.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| alter encoded_null_field = convert_to_base_64(dst_domain)
| fields event_id, dst_domain, encoded_null_field
| limit 5

Explanation: When the input to convert_to_base_64() is NULL (such as dst_domain for event 105), the function consistently returns NULL for the output field.

Output:

EVENT_ID DST_DOMAIN ENCODED_NULL_FIELD
101 ec2.amazonaws.com ZWMyLmFtYXpvbmF3cy5jb20=
102 sts.amazonaws.com c3RzLmFtYXpvbmF3cy5jb20=
103 www.google.com d3d3Lmdvb2dsZS5jb20=
104 dropbox.com ZHJvcGJveC5jb20=
105 NULL NULL