Can splunk convert input files contents from Hexadecimal to Decimal?

[Chris_R_]

Specifically monitoring a AppServer that outputs to a file storing in hexadecimal format.
Can we specify the charset when monitoring? (cant find it listed iconv -l) or any functions that can do a conversion or other methods to convert?

[Lowell]

There is a new search-time option for this scenario. In splunk 4.1.5 the tonumber() eval command was added. This function allows conversions between different bases which can convert from hexadecimal (base-16) to a standard (base 10) value.

| eval dec_value = tonumber(hex_value, 16)

Of course you'd have to do this many times depending on how many fields you have.

[Chris_R_]

I was sent some raw sample data, which brought up the question
2010-03-12 00:01:08 EST 0003f900 0003227a 0059 0059 0000 0001 00000000 0000 0002 00000000 00000001 00000001
2010-03-12 00:02:08 EST 0003f900 00031ce3 0059 0059 0000 0001 00000000 0000 0002 00000000 00000001 00000001
2010-03-12 00:03:08 EST 0003f900 000316d1 0059 0059 0000 0001 00000000 0000 0002 00000000 00000001 00000001

I imagine they wanted to convert the first two columns to decimal values. The scripted option of doing the conversion was on the table, ill go that route. Thanks for the help

[Paolo_Prigione]

Hi Chris, I'll second gkanapathy objections on hex and charset.

I'll add that if you know a way to convert your AppServer logs to a textual (meaningful) representation, you should be able to create a scripted input which runs the conversion script and imports its output. An example of this is the solaris utmpx data structures, which you can import by running the "last" command.

Paolo

[gkanapathy · Accepted solution]

It's not clear to me what you mean. "hexadecimal" is not a charset or character set. If you have hex data, it's actually either binary, or a text representation of binary data. Splunk will not convert this. In general, while Splunk handles different actual character sets of text, it does not convert generic data other than gzipped or similarly compressed data.