https://community.splunk.com/t5/Splunk-Search/tonumber-Not-Working/m-p/153304#M185614 <P>The WindowsLoginID field is represented in Hex format so use following. (see tonumber)</P> <PRE><CODE>index=charlesriver sourcetype="windows_events" WindowsLogonID=0x29019c75 | eval WindowsLoginID=tonumber(WindowsLoginID,16) | table _time ADLogon WindowsLoginID | sort -WindowsLoginID </CODE></PRE> Fri, 22 Nov 2013 21:22:10 GMT somesoni2 2013-11-22T21:22:10Z https://community.splunk.com/t5/Splunk-Search/tonumber-Not-Working/m-p/153303#M185613 <P>I have windows logs and I have extracted the Process ID's and Login ID's. I thought the | eval tonumber would work but it doesn't return anything.</P> <P>In this example my Login Id is 0x29019c75</P> <P>index=charlesriver sourcetype="windows_events" WindowsLogonID=0x29019c75 | eval WindowsLoginID=tonumber(WindowsLoginID) | table _time ADLogon WindowsLoginID | sort -WindowsLoginID</P> <P>(In case you are asking why, we are comparing the login id to what is logged in an application log)</P> Fri, 22 Nov 2013 21:07:58 GMT https://community.splunk.com/t5/Splunk-Search/tonumber-Not-Working/m-p/153303#M185613 andrewkenth 2013-11-22T21:07:58Z https://community.splunk.com/t5/Splunk-Search/tonumber-Not-Working/m-p/153304#M185614 <P>The WindowsLoginID field is represented in Hex format so use following. (see tonumber)</P> <PRE><CODE>index=charlesriver sourcetype="windows_events" WindowsLogonID=0x29019c75 | eval WindowsLoginID=tonumber(WindowsLoginID,16) | table _time ADLogon WindowsLoginID | sort -WindowsLoginID </CODE></PRE> Fri, 22 Nov 2013 21:22:10 GMT https://community.splunk.com/t5/Splunk-Search/tonumber-Not-Working/m-p/153304#M185614 somesoni2 2013-11-22T21:22:10Z