topic Re: Macro optimization in Knowledge Management

Macro optimization

chlima — Sat, 27 Sep 2014 19:36:46 GMT

Hi,

I've created a macro to convert IPv6 (IP field) to IPv4 connotation (Ex: 0000000000000000000000FFFF0a0a0a0a > 10.10.10.10)

Is that:

| eval a=tonumber(substr(IP,25,2))
| eval a=tonumber(substr(IP,27,2))
| eval a=tonumber(substr(IP,29,2))
| eval a=tonumber(substr(IP,31,2))
| IP = a+"."+b+"."+c+"."+d

Someone know another method more efficient to do it optimizing the macro execution?

Re: Macro optimization

lguinn2 — Sat, 27 Sep 2014 19:58:52 GMT

Why not

IP = tonumber(substr(IP,25,2),16) . "." . tonumber(substr(IP,27,2),16) . "." . tonumber(substr(IP,29,2),16) . "." . tonumber(substr(IP,31,2),16)

although I have no idea if that will actually be faster. It will work, because you have to specify the "16" to get it to convert from hex.

(edited to fix the problem mentioned in the comments - replaced "+" with ".", which is concatenation)

Re: Macro optimization

chlima — Sat, 27 Sep 2014 20:05:37 GMT

Thanks for the answer lguinn, but it's returning an error.

Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers.

So it that i've defined four variables (a,b,c,d).

Re: Macro optimization

woodcock — Mon, 29 Jun 2015 04:13:32 GMT

You can swap 4 substr commands with a single rex command and that should be very much quicker like this:

| rex field=32BitIP "(?i)(?<JuNkT3Mp_1>[0-9A-F]{2})(?<JuNkT3Mp_2>[0-9A-F]{2})(?<JuNkT3Mp_3>[0-9A-F]{2})(?<JuNkT3Mp_4>[0-9A-F]{2})"
| eval IP = tostring(tonumber(JuNkT3Mp_1,16)) . "."
          . tostring(tonumber(JuNkT3Mp_2,16)) . "." 
          . tostring(tonumber(JuNkT3Mp_3,16)) . "."
          . tostring(tonumber(JuNkT3Mp_4,16))
| fields - JuNkT3Mp*

Re: Macro optimization

woodcock — Tue, 23 Oct 2018 15:29:34 GMT

4 passes to substr vs. 1 pass to rex in mine (should be 4x faster)