topic Re: How do I convert Hexadecial to text? in Splunk Search

How do I convert Hexadecial to text?

Miguel3393 — Thu, 11 May 2023 15:15:17 GMT

In an index I have files in hexadecimal and I want to convert it to text in a search.

Is there a way to parse that file into hexadecimal and convert it to text

could you help me?, greetings

Re: How do I convert Hexadecial to text?

yuanliu — Thu, 11 May 2023 16:30:23 GMT

Do you mean convert to decimal, like tonumber(hex, 16)?

Re: How do I convert Hexadecial to text?

Miguel3393 — Thu, 11 May 2023 16:44:46 GMT

no, i want to convert hexadecimal to text.

Example:
(Hexadecimal) 20456C20636F7272656F20656C656374726F6E69636F206465207475206375656E74612073652061637475616C697A6F

(conver to text) El correo electrónico de tu cuenta se actualizo

Regards.

Re: How do I convert Hexadecial to text?

yuanliu — Thu, 11 May 2023 16:51:03 GMT

You can lookup printf() but I am doubtful that SPL comes with an explicit UTF or any other encoding conversion.

Re: How do I convert Hexadecial to text?

Miguel3393 — Thu, 11 May 2023 21:49:35 GMT

I was able to get the text from the hexadecimal like this:

But I need to do it by evaluating a file from an index, because I don't know the value that will come in hexadecimal, it will always come different.

Re: How do I convert Hexadecial to text?

yuanliu — Fri, 12 May 2023 04:26:13 GMT

Can you explain "I don't know the value that will come in hexadecimal?" You have an event in the index. You retrieve it, then apply urldecode. If that value comes in a specific field, just use that field. You need to illustrate raw data (anonymize as needed) and explain its feature related to this question.

Re: How do I convert Hexadecial to text?

Miguel3393 — Mon, 15 May 2023 15:41:13 GMT

Thanks for the answers, I managed to get what I was looking for with the following.

| eval value=('Tipo_Trafico')
| eval ascii=urldecode(ltrim(replace(value,"([a-fA-F0-9]{2})","%\1"),"0x"))