Splunk Enterprise Security

How to extract time string represented by hex (TA-sav)?

Path Finder

The sample data which comes with the TA-sav add-on has its timestamp in a weird hexadecimal format.
It looks like this: 2701140D2636. This number contains 6 hexadecimal octets. The first (27) is hex for the number of
years since 1970, 2nd (01) month, 3rd (day), 4th ( hour), 5th (minute) and 6th (seconds).

Can Splunk, via its transforms and props, convert this date to something which can be indexed or searched? If so, how?

0 Karma


That weird time is epoch time: http://en.wikipedia.org/wiki/Unix_time , measured in milliseconds since 1.1.1970 00:00 UTC.
You could split your hexadecimal value to octets with rex, convert each one to decimal with tonumber(hex) and then multiply them according to how many milliseconds that is (i.e., the first octet is 39 in decimal, multiplied by 31556926 to get 39 years in milliseconds). When you add those together, you get a timestamp in epoch. After you have that, Splunk will display the timestamp in human readable format when you look at it.

0 Karma

Path Finder

Looking to see if this can be done at index time.

0 Karma


Hm. I'd like to think it's possible, with a custom datetime extraction: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Configuretimestamprecognition I know you can work with hex data: http://answers.splunk.com/answers/4880/hex-encoded-unix-timestamp.html but I don't know how to go about and actually do it in this case.
What I tried so far is create a sample log file "sample_hex_epoch_log.txt" for testing purposes:

2701140D2636 site:up
270115AF1006 site:up
270115B16EFF site:up

I then set up an xml file "custom_hex_epoch.xml":

    <define name="_hexepoch" extract="hexyear, hexmonth, hexday, hexhour, hexminute, hexsecond">
        <use name="_hexepoch"/>

And I added this to props.conf:

DATETIME_CONFIG = /etc/custom_hex_epoch.xml

But when I try to import a sample log, it says "failed to parse timestamp". I'm unsure about the regex and about the rest of the xml though, maybe someone else can help shed some light here?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...