gzip_decompress_from_base64_string()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Decodes the input string from base64 and performs gzip decompression.

Syntax

gzip_decompress_from_base64_string(string)

Name	Type	Required	Description
string	`string`	✔️	The value that was compressed with gzip and then base64-encoded. The function accepts only one argument.

Note

This function checks mandatory gzip header fields (ID1, ID2, and CM) and returns an empty output if any of these fields have incorrect values.
The FLG byte is expected to be zero.
Optional header fields are not supported.

Returns a UTF-8 string that represents the original string.
Returns an empty result if decompression or decoding failed.
- For example, invalid gzip-compressed and base 64-encoded strings will return an empty output.

The following example shows how to decode a base64 string and decompress it using gzip and valid input.

print res=gzip_decompress_from_base64_string("H4sIAAAAAAAA/wEUAOv/MTIzNDU2Nzg5MHF3ZXJ0eXVpb3A6m7f2FAAAAA==")

res
"1234567890qwertyuiop"

The following example shows how to decode a base64 string and decompress it using gzip and invalid input.

print res=gzip_decompress_from_base64_string("x0x0x0")

res