https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55317#M13502 <P>Hi</P> <P>How to convet ip ?</P> <P>ex)<BR /> SRC_IP=-1234567890 ===&gt;&gt; SRC_IP=1.2.3.4 </P> Mon, 28 Sep 2020 10:20:28 GMT khyoung7410 2020-09-28T10:20:28Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55317#M13502 <P>Hi</P> <P>How to convet ip ?</P> <P>ex)<BR /> SRC_IP=-1234567890 ===&gt;&gt; SRC_IP=1.2.3.4 </P> Mon, 28 Sep 2020 10:20:28 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55317#M13502 khyoung7410 2020-09-28T10:20:28Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55318#M13503 <P>Have a look at this question and its answers: <A href="http://splunk-base.splunk.com/answers/24841/how-i-can-know-splunks-method-or-function-name-inside-splunk-module-if-i-need-to-write-python-script">http://splunk-base.splunk.com/answers/24841/how-i-can-know-splunks-method-or-function-name-inside-splunk-module-if-i-need-to-write-python-script</A></P> Fri, 20 Jan 2012 08:20:39 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55318#M13503 Ayn 2012-01-20T08:20:39Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55319#M13504 <P>Try this:</P> <PRE><CODE>| eval ipsi=-1978431425| eval ip=if(ipsi&lt;1,ipsi+2147483648,ipsi) | eval aaa=floor(ip/16777216) | eval bbb=floor((ip-aaa*16777216)/65536) | eval ccc=floor((ip-(aaa*16777216+bbb*65536))/256)| eval ddd=ip-(aaa*16777216+bbb*65536+ccc*256) | eval ipv4=tostring(aaa)+"."+tostring(bbb)+"."+tostring(ccc)+"."+tostring(ddd) | table ipsi ip ipv4 </CODE></PRE> Fri, 07 Jun 2013 07:22:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55319#M13504 JLeeatCBA 2013-06-07T07:22:38Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55320#M13505 <P>For some reason, something consumed the stars meaning multiply - so bbb65536 really means multiply bbb by 65536</P> Fri, 07 Jun 2013 07:25:08 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55320#M13505 JLeeatCBA 2013-06-07T07:25:08Z https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55321#M13506 <P>Fixed. Always indent code blocks with 4 spaces</P> Fri, 07 Jun 2013 09:25:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-convert-ip/m-p/55321#M13506 Ayn 2013-06-07T09:25:21Z