topic Re: How to convert 64-bit number from decimal to hex in Dashboards & Visualizations

How to convert 64-bit number from decimal to hex

helge — Tue, 27 Jun 2017 01:50:40 GMT

I would like to convert 64-bit numbers stored as decimal integers to a hexadecimal representation.
I am aware of the eval command tostring(dec, "hex"). It works well enough but seems to be limited to 32-bit integers.

Example: tostring(140726995023972, "hex") gives me 0x8E8C7864. The correct result would be 0x7FFD8E8C7864.

My question: is this documented?

I found this on Splunk 6.5.3 on Windows.

Re: How to convert 64-bit number from decimal to hex

inventsekar — Tue, 27 Jun 2017 02:48:34 GMT

that is a good catch. just for our reference, i am on splunk 6.3.4 on linux, it works fine.

| makeresults | eval number=140726995023972 | eval newnumber = tostring(140726995023972, "hex") |  table number newnumber

PS - tried to post as a comment, but comment wont allow photos upload, thus posting it as a answer.

Re: How to convert 64-bit number from decimal to hex

helge — Tue, 27 Jun 2017 10:09:43 GMT

Thanks for verifying on a different platform. I tried your exact search, too, and it confirms my findings. On Windows 6.5.3 it gives me the clipped 0x8E8C7864.

Re: How to convert 64-bit number from decimal to hex

inventsekar — Tue, 27 Jun 2017 11:10:32 GMT

just a thought - is your windows running on 32 bit or 64 bit?

Re: How to convert 64-bit number from decimal to hex

helge — Tue, 27 Jun 2017 13:24:02 GMT

I am running 64-bit Splunk on 64-bit Windows Server 2012 R2.

Re: How to convert 64-bit number from decimal to hex

niketn — Mon, 20 Nov 2017 20:31:12 GMT

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864

Re: How to convert 64-bit number from decimal to hex

helge — Mon, 20 Nov 2017 20:36:14 GMT

Thanks for your answer. I would love to report this to Splunk Support, however, as a lowly Splunk Technology Partner, I do not have a support entitlement.

Re: How to convert 64-bit number from decimal to hex

niketn — Mon, 20 Nov 2017 20:53:24 GMT

😄 ... I have added it to the list of paint points of Splunk Deployment on Windows OS maintained posted by @woodcock: https://answers.splunk.com/answers/516059/what-are-the-pain-points-with-deploying-your-splun.html?page=2&pageSize=10&sort=votes#answer-592720

Please try out the printf() command for 64 bit integer to hex conversion and confirm if it works for you on Windows.

Re: How to convert 64-bit number from decimal to hex

helge — Mon, 20 Nov 2017 20:59:36 GMT

I can confirm the workaround works on Splunk 6.6.3 on Windows, too.

Re: How to convert 64-bit number from decimal to hex

niketn — Fri, 24 Nov 2017 04:17:20 GMT

@helge, if the workaround has helped you resolve your issue, can you Accept the Answer?