There are plenty of answers to the question of how to convert Hex into ASCII using a combination of rex/replace and urldecode. However, I am looking to do the opposite. I have binary data in a field and I would like to convert it to hex values. Sample data: ����$P/�Dl ������E��4K@��v���3>n� � I do not simply want to strip this data because I actually would like to do something with it once it's been converted. I also would like to do it preferably using an eval statement so I can create a field calculation based on this. Any thoughts or ideas? ... View more

Issue DB Connect no longer stores results after query. It was working fine in the past, but now just doesn't work. Troubleshooting Steps Changed query in DB Input to something simpler Deleted and recreated DB Input, using as many default values as possible Created additional DB Inputs for same database Created additional DB Inputs for different databases on different hosts Ran tcpdump on all devices to ensure that DB Connect was able to successfully connect, query, and receive results Tried using different indexes and sourcetype names for each query Tried upgrading DB Connect app from 3.1.0 to 3.1.2. Results Splunk search-head successfully connects to port 3306 on target machine, performs query, receives results. Try to query results in Search (timeframe "All Time"); no results. Additional Info Splunk Enterprise v7.0 Splunk DB Connect v3.1.2 ... View more

Versions Splunk Enterprise v7.0.0 Cisco eStreamer eNcore v3.0.0 Problem I currently have an issue where eStreamer data for IPS events are showing an incorrect value for sid in alert data. The majority of entries do have the correct sid value, but some don't. In the cases where it doesn't, there's a metadata record that shows up in the logs that provides an id field (showing up as sid in IPS events) and then the correct sid field. Here's an example: eStreamer appears to be logging the correct sid everywhere else in our environment; Splunk is the only one that isn't. Expected Result Ideally, we would like to have IPS events have the actual sid in that field, not the internal database id. Anyone happen to have a solution to this? Any help would be greatly appreciated. ... View more