Splunk Search

Bitwise workaround

tincupchalice
Path Finder

I have a field StreamId=0x12da3b7514f19ce7
I want to do this:
(StreamId >> 😎 & 0xFFFFFFFF

I know I can /256 to shift 8, but I'm trying for a one-liner without any custom macros or search commands.

Without an extensive eval/if(if(if(if(...

Any suggestions?

Thanks,

Bob

Tags (2)
0 Karma

tincupchalice
Path Finder

| rex field=StreamId "0x(?<oct4>\S{2})(?<oct3>\S{2})(?<oct2>\S{2})(?<oct1>\S{2})(?<engine>\S{2})"

| eval oct1=tonumber(oct1, 16)

| eval oct2=tonumber(oct2, 16)

| eval oct3=tonumber(oct3, 16)

| eval oct4=tonumber(oct4, 16)

| eval Engine=tonumber(engine, 16)

| eval Machine=oct1.".".oct2.".".oct3.".".oct4

This worked for me, now I just need to | nslookup. Thanks for the input.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Yes, it's code - but this would probably be a good place for a dynamic lookup. Your lookup could perform the bitwise operations and return a new field with the new value.

martin_mueller
SplunkTrust
SplunkTrust

I don't think splunk does bitwise operations. After all, for bitwise operations you first need an agreement on how a number looks like in bits, and that doesn't feel splunky.

However, you can shimmy your way around that with a bit of maths. You already said how shifting is nothing else than dividing by a power of two and then flooring the result, that's the first step. Second, a bitwise and throwing out a number of starting bits and keeping all the bits after that is nothing other than a modulo operation. For instance 0x123 & 0xff is 0x23, yes? Going decimal, 0x123 is 291, doing 291 % 256 yields 35 - which is 0x23.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...