Knowledge Management

Macro optimization

chlima
Explorer

Hi,

I've created a macro to convert IPv6 (IP field) to IPv4 connotation (Ex: 0000000000000000000000FFFF0a0a0a0a > 10.10.10.10)

Is that:

| eval a=tonumber(substr(IP,25,2))
| eval a=tonumber(substr(IP,27,2))
| eval a=tonumber(substr(IP,29,2))
| eval a=tonumber(substr(IP,31,2))
| IP = a+"."+b+"."+c+"."+d

Someone know another method more efficient to do it optimizing the macro execution?

0 Karma
1 Solution

woodcock
Esteemed Legend

You can swap 4 substr commands with a single rex command and that should be very much quicker like this:

| rex field=32BitIP "(?i)(?<JuNkT3Mp_1>[0-9A-F]{2})(?<JuNkT3Mp_2>[0-9A-F]{2})(?<JuNkT3Mp_3>[0-9A-F]{2})(?<JuNkT3Mp_4>[0-9A-F]{2})"
| eval IP = tostring(tonumber(JuNkT3Mp_1,16)) . "."
          . tostring(tonumber(JuNkT3Mp_2,16)) . "." 
          . tostring(tonumber(JuNkT3Mp_3,16)) . "."
          . tostring(tonumber(JuNkT3Mp_4,16))
| fields - JuNkT3Mp*

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can swap 4 substr commands with a single rex command and that should be very much quicker like this:

| rex field=32BitIP "(?i)(?<JuNkT3Mp_1>[0-9A-F]{2})(?<JuNkT3Mp_2>[0-9A-F]{2})(?<JuNkT3Mp_3>[0-9A-F]{2})(?<JuNkT3Mp_4>[0-9A-F]{2})"
| eval IP = tostring(tonumber(JuNkT3Mp_1,16)) . "."
          . tostring(tonumber(JuNkT3Mp_2,16)) . "." 
          . tostring(tonumber(JuNkT3Mp_3,16)) . "."
          . tostring(tonumber(JuNkT3Mp_4,16))
| fields - JuNkT3Mp*
0 Karma

lguinn2
Legend

Why not

IP = tonumber(substr(IP,25,2),16) . "." . tonumber(substr(IP,27,2),16) . "." . tonumber(substr(IP,29,2),16) . "." . tonumber(substr(IP,31,2),16)

although I have no idea if that will actually be faster. It will work, because you have to specify the "16" to get it to convert from hex.

(edited to fix the problem mentioned in the comments - replaced "+" with ".", which is concatenation)

0 Karma

woodcock
Esteemed Legend

4 passes to substr vs. 1 pass to rex in mine (should be 4x faster)

0 Karma

chlima
Explorer

Thanks for the answer lguinn, but it's returning an error.

Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers.

So it that i've defined four variables (a,b,c,d).

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...