topic Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ? in Splunk Search

How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Muwafi — Sat, 10 Feb 2018 06:42:16 GMT

Hello Guys,

I'm working on Data which is exported by telecom devices and IPs is exported in Decimal format as 170468155

can you help to convert this to normal dotted quad IP format xxx.xxx.xxx.xxx ?

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Sukisen1981 — Sat, 10 Feb 2018 06:50:05 GMT

Hi,

Have you tried this?
| eval ips=tostring(ip)| eval newip=substr(ips,1,3)+"."+substr(ips,4,6)+"."+substr(ips,7,9)
Assuming your 170468155 is a field value for a field named ip

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

493669 — Sat, 10 Feb 2018 06:55:10 GMT

Have a look at this answer:
https://answers.splunk.com/answers/108752/converting-an-encoded-ip-address-to-dotted-decimal.html

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Muwafi — Sat, 10 Feb 2018 08:39:43 GMT

That didn't work!

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Muwafi — Sat, 10 Feb 2018 08:41:11 GMT

I saw that answer before asking my question.. it's a different case

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Sukisen1981 — Sat, 10 Feb 2018 08:58:43 GMT

didnt work? care to explain? can you post your event log containing your ip field?
What you are asking is very simple. I suspect we are not understanding your question completely

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Muwafi — Sat, 10 Feb 2018 09:16:33 GMT

it's giving a wrong result

if you used this website https://www.ipaddressguide.com/ip to convert between decimal IP and dotted quad IP the result of converting 170468155 is 10.41.35.59 while your eval result is 170.468155.155

The issue is not adding the "." , it needs calculations!

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Sukisen1981 — Sat, 10 Feb 2018 09:26:43 GMT

hang on a second...this is not strictly a splunk question, what you need is the logic to convert the decimal to ip (in general mathematical terms) and then implement the same in splunk.
Do you have the maths / formula behind the conversion?
We can then try to implement the same in splunk

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

Muwafi — Sat, 10 Feb 2018 09:28:56 GMT

I don't have the formula 😞

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

493669 — Sat, 10 Feb 2018 14:37:32 GMT

Hi @Muwafi,
If your decimal value is present in IP field then try this:

| eval ip=if(IP<1,IP+2147483648,IP) | eval aaa=floor(ip/16777216) | eval     bbb=floor((ip-aaa*16777216)/65536) | eval ccc=floor((ip-(aaa*16777216+bbb*65536))/256)| eval ddd=ip-(aaa*16777216+bbb*65536+ccc*256) | eval ipv4=tostring(aaa)+"."+tostring(bbb)+"."+tostring(ccc)+"."+tostring(ddd)

Try this run anywhere search:

|makeresults|eval IP="170468155"| eval ip=if(IP<1,IP+2147483648,IP) | eval aaa=floor(ip/16777216) | eval     bbb=floor((ip-aaa*16777216)/65536) | eval ccc=floor((ip-(aaa*16777216+bbb*65536))/256)| eval ddd=ip-(aaa*16777216+bbb*65536+ccc*256) | eval ipv4=tostring(aaa)+"."+tostring(bbb)+"."+tostring(ccc)+"."+tostring(ddd)

so for decimal val of IP="170468155" it will output as "10.41.35.59"

Re: How to convert Decimal IP address to dotted quad IPv4 using SPL ?

mgohman_splunk — Tue, 23 Oct 2018 23:48:18 GMT

I tested this app, it works. It's in splunkbase
IP Format Conversion Scripted Lookup