topic Re: Working with SHA1 value. in Splunk Search

How to convert SHA1 value to integer with base 16?

aps — Mon, 21 Nov 2022 03:41:37 GMT

Hi ,,

i am looking for the way if i could convert sha1 value to integer with base 16 to do the further arithmetic operations on it using eval.

i tried :

..... |eval sha=sha1("xyz123")|eval dec_number=tonumber(sha,16)

but dec_number is returning nothing. Could anyone suggest something ?

Re: Working with SHA1 value.

richgalloway — Sun, 20 Nov 2022 14:35:27 GMT

A SHA1 value would be an integer too big to represent in 64 bits, which probably is why tonumber fails.

What problem are you trying to solve?

Re: Working with SHA1 value.

aps — Sun, 20 Nov 2022 15:38:14 GMT

Hi @richgalloway

i need to filter some events based on "string SHA1" > decimal[16] integer value's mode operations.

Something like -
(SHA_Value.to_interger(16) % 100)

i was checking if i could achieve it by using "tonumber" function with eval for mode operation. if you could suggest some other method or trick would be appreciated.

Re: Working with SHA1 value.

yuanliu — Mon, 21 Nov 2022 08:51:29 GMT

As @richgalloway indicates, the problem is the scale of SHA1 that SPL cannot handle. I did some test, and uncovered extremely buggy behavior when an integer approaches and exceeds 10 trillion, or 10^13. (What are limitations of numeric calculation/representations?) In comparison, SHA1 is 40 digits HEX. Your best bet is an external command.