Knowledge Management

## Macro optimization

Explorer

Hi,

I've created a macro to convert IPv6 (IP field) to IPv4 connotation (Ex: `0000000000000000000000FFFF0a0a0a0a > 10.10.10.10`)

Is that:

``````| eval a=tonumber(substr(IP,25,2))
| eval a=tonumber(substr(IP,27,2))
| eval a=tonumber(substr(IP,29,2))
| eval a=tonumber(substr(IP,31,2))
| IP = a+"."+b+"."+c+"."+d
``````

Someone know another method more efficient to do it optimizing the macro execution?

Tags (5)
1 Solution
Esteemed Legend

You can swap 4 `substr` commands with a single `rex` command and that should be very much quicker like this:

``````| rex field=32BitIP "(?i)(?<JuNkT3Mp_1>[0-9A-F]{2})(?<JuNkT3Mp_2>[0-9A-F]{2})(?<JuNkT3Mp_3>[0-9A-F]{2})(?<JuNkT3Mp_4>[0-9A-F]{2})"
| eval IP = tostring(tonumber(JuNkT3Mp_1,16)) . "."
. tostring(tonumber(JuNkT3Mp_2,16)) . "."
. tostring(tonumber(JuNkT3Mp_3,16)) . "."
. tostring(tonumber(JuNkT3Mp_4,16))
| fields - JuNkT3Mp*
``````
Esteemed Legend

You can swap 4 `substr` commands with a single `rex` command and that should be very much quicker like this:

``````| rex field=32BitIP "(?i)(?<JuNkT3Mp_1>[0-9A-F]{2})(?<JuNkT3Mp_2>[0-9A-F]{2})(?<JuNkT3Mp_3>[0-9A-F]{2})(?<JuNkT3Mp_4>[0-9A-F]{2})"
| eval IP = tostring(tonumber(JuNkT3Mp_1,16)) . "."
. tostring(tonumber(JuNkT3Mp_2,16)) . "."
. tostring(tonumber(JuNkT3Mp_3,16)) . "."
. tostring(tonumber(JuNkT3Mp_4,16))
| fields - JuNkT3Mp*
``````
Legend

Why not

``````IP = tonumber(substr(IP,25,2),16) . "." . tonumber(substr(IP,27,2),16) . "." . tonumber(substr(IP,29,2),16) . "." . tonumber(substr(IP,31,2),16)
``````

although I have no idea if that will actually be faster. It will work, because you have to specify the "16" to get it to convert from hex.

(edited to fix the problem mentioned in the comments - replaced "+" with ".", which is concatenation)

Esteemed Legend

4 passes to `substr` vs. 1 pass to `rex` in mine (should be 4x faster)

Explorer

Thanks for the answer lguinn, but it's returning an error.

Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers.

So it that i've defined four variables (a,b,c,d).

Get Updates on the Splunk Community!

#### How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

#### Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

#### Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...