Dashboards & Visualizations

How to convert 64-bit number from decimal to hex

helge
Builder

I would like to convert 64-bit numbers stored as decimal integers to a hexadecimal representation.
I am aware of the eval command tostring(dec, "hex"). It works well enough but seems to be limited to 32-bit integers.

Example: tostring(140726995023972, "hex") gives me 0x8E8C7864. The correct result would be 0x7FFD8E8C7864.

My question: is this documented?

I found this on Splunk 6.5.3 on Windows.

0 Karma
1 Solution

niketn
Legend

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

helge
Builder

I can confirm the workaround works on Splunk 6.6.3 on Windows, too.

niketn
Legend

@helge, if the workaround has helped you resolve your issue, can you Accept the Answer?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

helge
Builder

Thanks for your answer. I would love to report this to Splunk Support, however, as a lowly Splunk Technology Partner, I do not have a support entitlement.

0 Karma

niketn
Legend

😄 ... I have added it to the list of paint points of Splunk Deployment on Windows OS maintained posted by @woodcock: https://answers.splunk.com/answers/516059/what-are-the-pain-points-with-deploying-your-splun.html?pa...

Please try out the printf() command for 64 bit integer to hex conversion and confirm if it works for you on Windows.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

inventsekar
Ultra Champion

that is a good catch. just for our reference, i am on splunk 6.3.4 on linux, it works fine.

| makeresults | eval number=140726995023972 | eval newnumber = tostring(140726995023972, "hex") |  table number newnumber 

PS - tried to post as a comment, but comment wont allow photos upload, thus posting it as a answer.

alt text

0 Karma

helge
Builder

Thanks for verifying on a different platform. I tried your exact search, too, and it confirms my findings. On Windows 6.5.3 it gives me the clipped 0x8E8C7864.

0 Karma

inventsekar
Ultra Champion

just a thought - is your windows running on 32 bit or 64 bit?

0 Karma

helge
Builder

I am running 64-bit Splunk on 64-bit Windows Server 2012 R2.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...