https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268531#M189952 <P>While it will take a minor amount of programming skills (probably not a lot), I think a <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/AdvancedDev/ScriptedInputsIntro">scripted input</A> may be your best choice. You could use either method described: stream it in via the script, or use the script to rewrite to a new file that Splunk reads. Either way, it's basically that you use the script to modify the latitude and longitude fields first into something like whate you need.</P> Sat, 10 Oct 2015 01:33:29 GMT Richfez 2015-10-10T01:33:29Z https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268526#M189947 <P>Hello I need to use the mathematical opération called "two's complement".<BR /> In C programming language it is written like that : <BR /> Complement=~B</P> <P>I can't find a function similar in Splunk. If someone has an idea.</P> <P>Regards</P> Fri, 09 Oct 2015 15:13:24 GMT https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268526#M189947 clorne 2015-10-09T15:13:24Z https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268527#M189948 <P>What exactly are you trying to accomplish with two's complement? Perhaps there is another way to achieve your goal.</P> Fri, 09 Oct 2015 16:58:50 GMT https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268527#M189948 richgalloway 2015-10-09T16:58:50Z https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268528#M189949 <P>Hello richgalloway.<BR /> Thanks for your reply.<BR /> I have a log containing traffic data regarding planes. The purpose is to represent where the planes are. <BR /> In the log, the latitude and longitude are coded in "hex two's complement".<BR /> I need to translate the data in order to use the geostats function. </P> <P>Since I did not find the function, I am preparing myself to translate each Hexadecimal character in binary code. And then replace each 1 by zero and each zero by one. But if I could find the function already done ...</P> <P>Regards</P> Fri, 09 Oct 2015 18:33:18 GMT https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268528#M189949 clorne 2015-10-09T18:33:18Z https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268529#M189950 <P>I'm not aware of any function that will perform that calculation.</P> Fri, 09 Oct 2015 19:59:15 GMT https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268529#M189950 richgalloway 2015-10-09T19:59:15Z https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268530#M189951 <P>I don't think there is a function for that, but maybe you can use the answer below to save yourself some work. I guess you could just flip the bits during the replace as well?</P> <P><A href="http://answers.splunk.com/answers/222813/convert-an-hexadecimal-field-to-binary.html#answer-221785">http://answers.splunk.com/answers/222813/convert-an-hexadecimal-field-to-binary.html#answer-221785</A></P> Sat, 10 Oct 2015 00:02:00 GMT https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268530#M189951 maciep 2015-10-10T00:02:00Z https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268531#M189952 <P>While it will take a minor amount of programming skills (probably not a lot), I think a <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/AdvancedDev/ScriptedInputsIntro">scripted input</A> may be your best choice. You could use either method described: stream it in via the script, or use the script to rewrite to a new file that Splunk reads. Either way, it's basically that you use the script to modify the latitude and longitude fields first into something like whate you need.</P> Sat, 10 Oct 2015 01:33:29 GMT https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268531#M189952 Richfez 2015-10-10T01:33:29Z https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268532#M189953 <P>Thanks Maciep for your reply. I will be obliged to do this "string" manipulation since there is no binary operator<BR /> I do not vote for that because it seems very weird to me ...</P> Thu, 15 Oct 2015 12:26:06 GMT https://community.splunk.com/t5/Splunk-Search/two-s-complement/m-p/268532#M189953 clorne 2015-10-15T12:26:06Z