Dashboards & Visualizations

How to convert 64-bit number from decimal to hex

helge
Builder

I would like to convert 64-bit numbers stored as decimal integers to a hexadecimal representation.
I am aware of the eval command tostring(dec, "hex"). It works well enough but seems to be limited to 32-bit integers.

Example: tostring(140726995023972, "hex") gives me 0x8E8C7864. The correct result would be 0x7FFD8E8C7864.

My question: is this documented?

I found this on Splunk 6.5.3 on Windows.

0 Karma
1 Solution

niketnilay
Legend

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

helge
Builder

I can confirm the workaround works on Splunk 6.6.3 on Windows, too.

niketnilay
Legend

@helge, if the workaround has helped you resolve your issue, can you Accept the Answer?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

helge
Builder

Thanks for your answer. I would love to report this to Splunk Support, however, as a lowly Splunk Technology Partner, I do not have a support entitlement.

0 Karma

niketnilay
Legend

😄 ... I have added it to the list of paint points of Splunk Deployment on Windows OS maintained posted by @woodcock: https://answers.splunk.com/answers/516059/what-are-the-pain-points-with-deploying-your-splun.html?pa...

Please try out the printf() command for 64 bit integer to hex conversion and confirm if it works for you on Windows.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

inventsekar
Super Champion

that is a good catch. just for our reference, i am on splunk 6.3.4 on linux, it works fine.

| makeresults | eval number=140726995023972 | eval newnumber = tostring(140726995023972, "hex") |  table number newnumber 

PS - tried to post as a comment, but comment wont allow photos upload, thus posting it as a answer.

alt text

>>> Happy Splunking !
0 Karma

helge
Builder

Thanks for verifying on a different platform. I tried your exact search, too, and it confirms my findings. On Windows 6.5.3 it gives me the clipped 0x8E8C7864.

0 Karma

inventsekar
Super Champion

just a thought - is your windows running on 32 bit or 64 bit?

>>> Happy Splunking !
0 Karma

helge
Builder

I am running 64-bit Splunk on 64-bit Windows Server 2012 R2.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...