Automatic conversion from HEX to text

[kokobin]

Hello everyone,

I have around 3600 events to review but they all are encoded in HEX, I know I can decode them by hand one by one but this will take a lot of time which i do not have, I spent a few hours reading for similar problems here but none helped me, I found an app called decode2 but it was not able to help me either, it wants me to feed it a table to decode and I only have 2 tables, one called time and one called event, nothing else, pointing it to event returns nothing.

bellow I'm posting 2 of the events as sample

```\hex string starts here\x00\x00\x00n
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x005\xE6\x00ppt/tags/tag6.\x00\x00\x00\x00]\x00]\x00\xA9\x00\x00N\xE7\x00\x00\x00

\hex start\x00\x00\x00n
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE5\x00ppt/tags/tag3.
-\x00\x00\x00\x00\x00\x00!\x00\xA1

i chanced the first part of the string because it did not let me post, i also deleted the part between tag6. and the next slash, same goes for tag3.-

is there a way to automatically convert all events from hex to text?

[richgalloway]

You appear to have a hex dump of binary data.  Decoding the hex will give you the original binary, but Splunk doesn't support binary data.

I've seen similar-looking input when an encrypted input stream is not decrypted before being indexed.  Double-check the TLS/SSL settings.

[kokobin]

these are all static, I was given a .pptx file and asked to find certain events, that wouldn't be a problem if the data was in plaintext, the instance is running on my machine so no TSL is involved, correct me if I'm wrong, is there anything I can do to actually use this data? without having to decode to binary and then ascii manually

[richgalloway]

Splunk is not going to be able to process that binary PowerPoint file without some pre-processing (manual or via a script).