topic Re: IPV6 convert to ipv4 in Splunk Search

How to convert IPV6 to ipv4?

khyoung7410 — Wed, 18 May 2022 16:24:24 GMT

Among the data stored in splunk is in ipv6 format. I want to know how to convert the ipv6 format to the ipv4 format. In addition, ipv6 format to ipv4 format would like to know how to convert when reading know file.

Re: IPV6 convert to ipv4

FrankVl — Mon, 11 Nov 2019 09:37:20 GMT

IPv6 is a completely different addressing scheme than IPv4. You can't translate IPv6 addresses to IPv4 addresses.

The only thing I can think of is that you have IPv4 addresses in this notation: ::ffff:10.0.0.1. If that is the case, you can simply strip off the ::ffff: bit with whatever approach suits you.

Maybe I'm missing something, but then please explain a bit further what issue you have and what you want to achieve. Some sample data is always helpful for improving our understanding of your question.

Re: IPV6 convert to ipv4

jamesjarrett — Wed, 18 May 2022 15:22:48 GMT

@FrankVl wrote:
IPv6 is a completely different addressing scheme than IPv4. You can't translate IPv6 addresses to IPv4 addresses.

In this instance im 99.999% sure he's talking about IPv4 in IPv6 and converting it back to IPv4. So Yes. But no. We're dealing with this right now (we're are borg, you will be assimilated). IPv6 is not IPv4 but IPv6 can encapsulate (thats the word i chose, deal with it 😄 ) IPv4. Salesforce does this. You get something like ...

0000:0000:0000:0000:0000:ffff:abcd:ef01

in this example ab is first octet, cd is second, ef is third, and 01 is fourth. you have a couple of options for dealing with this but all of them start with an extract of the octets and then involve an EVAL- that puts them back together. The only difference is that instead of doing a tonumber() repeatedly, you could add the option of using a lookup table instead which may save some processing power for LISPY (or not given all the extra steps; i have no idea).

The easiest option after EXTRACTing out the octets is...

EVAL-ipaddr = tonumber(hex_value, oct1)+"."+tonumber(hex_value, oct2)+"."+tonumber(hex_value, oct3)+"."tonumber(hex_value, oct4)

If someone has a better way, i'd love to hear it. If not please accept this answer so i get coolness points.