Splunk Search

Bitwise workaround

tincupchalice
Path Finder

I have a field StreamId=0x12da3b7514f19ce7
I want to do this:
(StreamId >> 😎 & 0xFFFFFFFF

I know I can /256 to shift 8, but I'm trying for a one-liner without any custom macros or search commands.

Without an extensive eval/if(if(if(if(...

Any suggestions?

Thanks,

Bob

Tags (2)
0 Karma

tincupchalice
Path Finder

| rex field=StreamId "0x(?<oct4>\S{2})(?<oct3>\S{2})(?<oct2>\S{2})(?<oct1>\S{2})(?<engine>\S{2})"

| eval oct1=tonumber(oct1, 16)

| eval oct2=tonumber(oct2, 16)

| eval oct3=tonumber(oct3, 16)

| eval oct4=tonumber(oct4, 16)

| eval Engine=tonumber(engine, 16)

| eval Machine=oct1.".".oct2.".".oct3.".".oct4

This worked for me, now I just need to | nslookup. Thanks for the input.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Yes, it's code - but this would probably be a good place for a dynamic lookup. Your lookup could perform the bitwise operations and return a new field with the new value.

martin_mueller
SplunkTrust
SplunkTrust

I don't think splunk does bitwise operations. After all, for bitwise operations you first need an agreement on how a number looks like in bits, and that doesn't feel splunky.

However, you can shimmy your way around that with a bit of maths. You already said how shifting is nothing else than dividing by a power of two and then flooring the result, that's the first step. Second, a bitwise and throwing out a number of starting bits and keeping all the bits after that is nothing other than a modulo operation. For instance 0x123 & 0xff is 0x23, yes? Going decimal, 0x123 is 291, doing 291 % 256 yields 35 - which is 0x23.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...