Basic manipulation of data from events

Hi omarecd ,

In KQL, can I decode from base64?

Yes, and you can try to use the base64_decode_toarray() and array_concat() functions to decode Base64 data. For example:

// Sample data
let eventData = datatable (EncodedData: string)
[
    "U29tZSBleGFtcGxlIGJhc2U2NCBlbmNvZGVkIHN0cmluZw==",
    "QW5vdGhlciBlbmNvZGVkIGV4YW1wbGU="
];

// Decoding Base64
eventData
| extend DecodedData = todynamic(base64_decode_toarray(EncodedData))
| extend DecodedText = array_concat(DecodedData)

And about:

I would like this new column to be populated automatically each time that a new message arrives...

There is probably no way to accomplish this using only the KQL database. Perhaps you can try using Azure Data Explorer (ADX) or Azure Functions to achieve your desired results.

You can set up a continuous query or a scheduled job in your Azure Data Explorer (ADX) to process the data stream.

Here's an example of a scheduled query in ADX:

.create continuous-export MyContinuousExport
into table DecodedEventData
<|
myEventStream
| extend DecodedData = todynamic(base64_decode_toarray(EncodedData))
| extend DecodedText = array_concat(DecodedData)

However, whether you choose Azure Data Explorer (ADX) or Azure Functions, it is beyond the scope of technical support that this forum can provide. The suggestions I can provide are very limited. I suggest you go to other related forums to ask specifically whether you can use these tools to automatically fill in columns. Thank you!

Best Regards,
Dino Tao
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.