topic Re: ip2decimal command is exist. Is decimal2ip command exist? in Getting Data In

ip2decimal command is exist. Is decimal2ip command exist?

joy76 — Mon, 28 Sep 2020 09:58:31 GMT

Hi~

ip2decimal command is exist. Is decimal2ip command exist?

example>

| eval foo="210.192.120.23" | ip2decimal | table ipdecimal

result>>>> ipdecimal=2130706433

I want convert decimal_ip to dot_ip
"2130706433" >>> "210.192.120.23"

I will try to make a user command by python.

take care.

Re: ip2decimal command is exist. Is decimal2ip command exist?

gkanapathy — Wed, 12 Oct 2011 05:36:01 GMT

First of all, your math seems to be wrong. I don't really know what you're trying to convert, but I don't see how an IP of 210.192.120.23 converts to 2130706433. I could see it converting to hex 0xd2c07817, which is decimal 3535829015. Assuming that's what you're working with, you could simply do:

... | eval ipdecimal=3535829015 | eval ip=(floor(ipdecimal/16777216)%256).".".(floor(ipdecimal/65536)%256).".".(floor(ipdecimal/256)%256).".".(ipdecimal%256)

And really, the ip2decimal command is a waste of time. It is much more efficient in Splunk to simply do:

... | eval ip="210.192.120.23" | eval ipmv=split(ip,".") | eval ipdecimal=(mvindex(ipmv,0)*16777216)+(mvindex(ipmv,1)*65536)+(mvindex(ipmv,2)*256)+mvindex(ipmv,3)

Re: ip2decimal command is exist. Is decimal2ip command exist?

joy76 — Wed, 12 Oct 2011 06:43:26 GMT

Thanks a lot for you help.
I solved problem for your advice.
P.S.
this is correct.
... | eval ip="210.192.120.23" | eval ipdecimal=(tonumber(mvindex(ipmv,0),10)*16777216)+(tonumber(mvindex(ipmv,1),10)*65536)+(tonumber(mvindex(ipmv,2),10)*256)+tonumber(mvindex(ipmv,3),10)

I appreciate that your help again.

Re: ip2decimal command is exist. Is decimal2ip command exist?

magnusmolbach — Tue, 29 Sep 2020 11:49:44 GMT

Hi!
You could add this in props.conf (this is two lines, one for DestinationIP-field and one for ClientIP;

EVAL-dst = if(DestinationIP!=0,tostring(floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216))+"."+tostring(floor((if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)-floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216)*16777216)/65536))+"."+tostring(floor((if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)-(floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216)*16777216+floor((if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)-floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216)*16777216)/65536)*65536))/256))+"."+tostring(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)-(floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216)*16777216+floor((if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)-floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216)*16777216)/65536)*65536+floor((if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)-(floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216)*16777216+floor((if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)-floor(if(DestinationIP<1,DestinationIP+2147483648,DestinationIP)/16777216)*16777216)/65536)*65536))/256)*256)),0)

EVAL-src = if(ClientIP!=0,tostring(floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216))+"."+tostring(floor((if(ClientIP<1,ClientIP+2147483648,ClientIP)-floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216)*16777216)/65536))+"."+tostring(floor((if(ClientIP<1,ClientIP+2147483648,ClientIP)-(floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216)*16777216+floor((if(ClientIP<1,ClientIP+2147483648,ClientIP)-floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216)*16777216)/65536)*65536))/256))+"."+tostring(if(ClientIP<1,ClientIP+2147483648,ClientIP)-(floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216)*16777216+floor((if(ClientIP<1,ClientIP+2147483648,ClientIP)-floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216)*16777216)/65536)*65536+floor((if(ClientIP<1,ClientIP+2147483648,ClientIP)-(floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216)*16777216+floor((if(ClientIP<1,ClientIP+2147483648,ClientIP)-floor(if(ClientIP<1,ClientIP+2147483648,ClientIP)/16777216)*16777216)/65536)*65536))/256)*256)),0)