https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152730#M42790 <P>I have a query that returns a few values of binary data instead of the actual data. How can I return the actual data instead of the blob reference?</P> Wed, 17 Dec 2014 19:08:44 GMT randymw59 2014-12-17T19:08:44Z https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152730#M42790 <P>I have a query that returns a few values of binary data instead of the actual data. How can I return the actual data instead of the blob reference?</P> Wed, 17 Dec 2014 19:08:44 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152730#M42790 randymw59 2014-12-17T19:08:44Z https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152731#M42791 <P>Way more details please - sample events, how you've setup log ingestion for these events, what search you're using, what you mean by blob reference, etc etc. We don't know your setup or your situation so you have to tell us if we're to stand a chance of helping you!</P> Wed, 17 Dec 2014 20:05:34 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152731#M42791 Ayn 2014-12-17T20:05:34Z https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152732#M42792 <P>This is just a simple query against Active Directory. When pulling information from AD for a list of IDs, a few descriptions are coming back as binary-blob instead of the actual description within AD.</P> Wed, 17 Dec 2014 20:11:43 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152732#M42792 randymw59 2014-12-17T20:11:43Z https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152733#M42793 <P>something like this <A href="http://answers.splunk.com/answers/10346/splunk-is-adding-weird-strings-like-linebreaker-x00-x00-to-my-events-what-is-going-on.html">http://answers.splunk.com/answers/10346/splunk-is-adding-weird-strings-like-linebreaker-x00-x00-to-my-events-what-is-going-on.html</A> ?</P> Wed, 17 Dec 2014 20:26:40 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152733#M42793 MuS 2014-12-17T20:26:40Z https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152734#M42794 <P>No, it literally has binary-blob (surrounded by &lt; and &gt;, but I can't enter that here) in the description column instead of an actual description.</P> Wed, 17 Dec 2014 20:31:11 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152734#M42794 randymw59 2014-12-17T20:31:11Z https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152735#M42795 <P>please give, more details</P> Fri, 19 Dec 2014 08:57:14 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152735#M42795 Tanefo 2014-12-19T08:57:14Z https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152736#M42796 <P>If you have binary data in your input file, but you want to see or search on decoded data you have some choices:</P> <UL> <LI>Use a modular input to decode the data on the way in to Splunk</LI> <LI>Use a custom Python command to decode the data at search time</LI> </UL> <P>Both options require development, and depending on your usage it might be better to choose one or the other:</P> <UL> <LI>The modular input is likely better if you primarily want to search for values in the decoded data</LI> <LI>The python input is simpler to implement and if it's just decoding some events at search time the extra processing on search is probably worth it</LI> </UL> <P>The Python SDK contains examples of both</P> Fri, 19 Dec 2014 15:00:04 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-search-query-returning-values-of-binary-data-and-how-to/m-p/152736#M42796 dturnbull_splun 2014-12-19T15:00:04Z