Getting Data In

Can splunk convert input files contents from Hexadecimal to Decimal?

Chris_R_
Splunk Employee
Splunk Employee

Specifically monitoring a AppServer that outputs to a file storing in hexadecimal format.
Can we specify the charset when monitoring? (cant find it listed iconv -l) or any functions that can do a conversion or other methods to convert?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

It's not clear to me what you mean. "hexadecimal" is not a charset or character set. If you have hex data, it's actually either binary, or a text representation of binary data. Splunk will not convert this. In general, while Splunk handles different actual character sets of text, it does not convert generic data other than gzipped or similarly compressed data.

View solution in original post

Lowell
Super Champion

There is a new search-time option for this scenario. In splunk 4.1.5 the tonumber() eval command was added. This function allows conversions between different bases which can convert from hexadecimal (base-16) to a standard (base 10) value.

| eval dec_value = tonumber(hex_value, 16)

Of course you'd have to do this many times depending on how many fields you have.

Chris_R_
Splunk Employee
Splunk Employee

I was sent some raw sample data, which brought up the question
2010-03-12 00:01:08 EST 0003f900 0003227a 0059 0059 0000 0001 00000000 0000 0002 00000000 00000001 00000001
2010-03-12 00:02:08 EST 0003f900 00031ce3 0059 0059 0000 0001 00000000 0000 0002 00000000 00000001 00000001
2010-03-12 00:03:08 EST 0003f900 000316d1 0059 0059 0000 0001 00000000 0000 0002 00000000 00000001 00000001

I imagine they wanted to convert the first two columns to decimal values. The scripted option of doing the conversion was on the table, ill go that route. Thanks for the help

0 Karma

Paolo_Prigione
Builder

Hi Chris, I'll second gkanapathy objections on hex and charset.

I'll add that if you know a way to convert your AppServer logs to a textual (meaningful) representation, you should be able to create a scripted input which runs the conversion script and imports its output. An example of this is the solaris utmpx data structures, which you can import by running the "last" command.

Paolo

gkanapathy
Splunk Employee
Splunk Employee

It's not clear to me what you mean. "hexadecimal" is not a charset or character set. If you have hex data, it's actually either binary, or a text representation of binary data. Splunk will not convert this. In general, while Splunk handles different actual character sets of text, it does not convert generic data other than gzipped or similarly compressed data.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...