Splunk Search

Why are some of the fields showing ascii hex values for string after I get CEF stream data into splunk using cefutils?

sdesigowda
New Member

Using cefutils I am able to get CEF stream data into Splunk. The issue is some of the fields are showing ascii hex values for a string.
Here is an example CEF data:

Thu Feb  8 07:08:10 2018 1/1/e1 CEF:23|XYZ|metadata|5.3.00|4|metadata generation|6|XYZMdataSslIssuerName=Google Internet Authority G2 dpt=63911 XYZMdataSslValidNotBefore=3138303131363038353430395a XYZMdataSslSerialNo=799d1de89c3718b6000000000000000000000000 XYZMdataSslValidNotAfter=3138303431303038343230305a XYZMdataSslCertSigAlgo=2a864886f70d01010b XYZMdataSslCertSubAlgo=2a8648ce3d02010000 XYZMdataSslCertSubKeySize=65 XYZMdataSslServerVersion=771 XYZMdataSslCertSubAltName=*.google.com XYZMdataSslServerCompressionMethod=192 XYZMdataSslServerCipher=49195 XYZMdataSslServerVersionText=TLSv1.2 XYZMdataSslServerSessionId=125 XYZMdataSslIssuer=2f433d55532f4f3d476f6f676c6520496e632f434e3d476f6f676c6520496e7465726e657420417574686f72697479204732 XYZMdataSslCertSubCommonName=*.google.com XYZMdataSslSub=2f433d55532f53543d43616c69666f726e69612f4c3d4d6f756e7461696e20566965772f4f3d476f6f676c6520496e632f434e3d2a2e676f6f676c652e636f6d dst=10.40.21.68 src=216.58.218.206 spt=443 

Look into XYZMdataSslIssuer=2f433d55532f4f3d476f6f676c6520496e632f434e3d476f6f676c6520496e7465726e657420417574686f72697479204732.
value for key "XYZMdataSslIssue" is a string. It's showing ASCII values of character of a string. Where do I make a change so that cefutil ingests this value as string? It's just one example. There are other fields which have different values like date, integer etc.

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval XYZMdataSslIssuer="2f433d55532f4f3d476f6f676c6520496e632f434e3d476f6f676c6520496e7465726e657420417574686f72697479204732"
| rex field=XYZMdataSslIssuer mode=sed "s/(\w{2})/%\1/g"
| eval XYZMdataSslIssuer=urldecode(XYZMdataSslIssuer)

HEX decode is usefull using rex mode=sed and urldecode()

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...