I would like to convert 64-bit numbers stored as decimal integers to a hexadecimal representation.
I am aware of the
tostring(dec, "hex"). It works well enough but seems to be limited to 32-bit integers.
tostring(140726995023972, "hex") gives me 0x8E8C7864. The correct result would be 0x7FFD8E8C7864.
My question: is this documented?
I found this on Splunk 6.5.3 on Windows.
that is a good catch. just for our reference, i am on splunk 6.3.4 on linux, it works fine.
| makeresults | eval number=140726995023972 | eval newnumber = tostring(140726995023972, "hex") | table number newnumber
PS - tried to post as a comment, but comment wont allow photos upload, thus posting it as a answer.
Thanks for verifying on a different platform. I tried your exact search, too, and it confirms my findings. On Windows 6.5.3 it gives me the clipped 0x8E8C7864.
@helge, I tested on
Splunk Enterprise 7.0 on
Windows 10 64 bit and can see the issue with
tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.
Workaround: Try using
printf() command, with argument as
%X, to convert to 64-bit hexadecimal.
Following is the run anywhere search:
| makeresults | eval data="140726995023972" | eval dataHexUsingTostring=tostring(140726995023972, "hex") | eval dataHexUsingPrintf=printf("%X",data) | table data dataHexUsingTostring dataHexUsingPrintf
Following is the output:
data dataHexUsingTostring dataHexUsingPrintf 140726995023972 0x8E8C7864 7FFD8E8C7864
Thanks for your answer. I would love to report this to Splunk Support, however, as a lowly Splunk Technology Partner, I do not have a support entitlement.
😄 ... I have added it to the list of paint points of Splunk Deployment on Windows OS maintained posted by @woodcock: https://answers.splunk.com/answers/516059/what-are-the-pain-points-with-deploying-your-splun.html?pa...
Please try out the
printf() command for 64 bit integer to hex conversion and confirm if it works for you on Windows.
@helge, if the workaround has helped you resolve your issue, can you Accept the Answer?