decode() function seem to not look for codecs

[trafford-tbe]

Hello,

I'm trying to make use of decode() with flowing example in Splunk:

| makeresults
| eval fd="um\xc3\xb3w"
| decrypt field=fd decode('utf_8')

but not matter what I put in place of codec (even '??') I'm getting something like:

_time	fd	decrypted
2023-09-20 14:26:47	um\xc3\xb3w	um\xc3\xb3w

instead of decoded umów.

[gjanders]

I attempted to fix it but I think that Splunk might be overriding my fix for utf-8!

In decryptlib.py I added after line 86:
if isinstance(data, str):
data = str.encode(data)

This ensures that if the data comes through as a string (which I believe it always will), it will be encoded and then decoded later in the code.

In my testing with utf-16 it works fine (as in the string you have isn't working quite right but I'm getting a decoded value), however with utf-8 I see the value come back the same!

[trafford-tbe]

I can confirm, that using codes works, but playing around with my example I found that passing it literally would do the job.
Therefore I'm coming with new function suggestion:
#23
Note that, I'm not developer by all means, just reading solutions over Internet, so if you think you could polish this suggestion then do it.

[gjanders]

Can you try :
| makeresults
| eval fd="um\xc3\xb3w"
| decrypt field=fd unescape()

And see if that works?

[trafford-tbe]

Wow, that's great!
This is the reason why I'm not developer :)
I'll close #23 as not needed. How about 25a1c67 is it still needed for decode()?

[gjanders]

Technically this is a fork of "version 2.3.1 of DECRYPT app from SplunkBase (under MIT license)", so I'm not the original developer
They definitely used some interesting python tricks while building the app while I spend only a some of my time developing.

That decode function might still be useful in some use cases, however there is definitely no rush to get it released as no one has asked for it and it didn't resolve the scenario you mentioned which was the goal...

[trafford-tbe]

Well, then feel free to keep or close this issue, as my final goal is already resolved, and this issue was supposed to be only the step to resolve that.
Now it's separate issue not crucial for my use case.

[malvidin]

I expect this to work too:

| makeresults
| eval fd="um\xc3\xb3w"
| decrypt field=fd unescape() decode("utf_8")

The decode command is not necessary because an emit() function is added if you omit it, and the emit() function outputs UTF-8 that Splunk expects.
My original thought was that decode() would only work on bytes. If there is a need for an encode() function so that strings can be converted to specific encodings, let me know.