Convert Hexadecimal IP(v4) addresses to decimal?

[NK_1]

Logged output is like:
... ip: 0xAABBCCDD, ...

I'd like to convert the AABBCCDD to 170.187.204.221, and map the locations.

I'm currently doing:

sourcetype=MySource daysago=1 | rex field=_raw "(?i)0x(?P[^,]+)" | eval d1=tonumber(substr(hip,1,2), 16) | eval d2=tonumber(substr(hip,3,2), 16) | eval d3=tonumber(substr(hip,5,2), 16) | eval d4=tonumber(substr(hip,7,2), 16) | eval dip=d1+"."+d2+"."+d3+"."+d4 | geoip dip

Any more efficient method of doing the conversion?

Thanks.

[ziegfried · Accepted solution]

One thing that will probably make it more efficient is to reduce the number of operations:

... | rex "(?i)0x(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) | geoip ip

Since the geoip command is converting the IP back to an integer, it might be a good idea to extend the command to allow the processing of integer values directly. I'll probably add this in the future.

[Wiggy]

I tried some sample events myself and it looks like you have a pretty good solution here.