- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: IPV6 convert to ipv4
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to convert IPV6 to ipv4?
Among the data stored in splunk is in ipv6 format. I want to know how to convert the ipv6 format to the ipv4 format. In addition, ipv6 format to ipv4 format would like to know how to convert when reading know file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IPv6 is a completely different addressing scheme than IPv4. You can't translate IPv6 addresses to IPv4 addresses.
The only thing I can think of is that you have IPv4 addresses in this notation: ::ffff:10.0.0.1. If that is the case, you can simply strip off the ::ffff: bit with whatever approach suits you.
Maybe I'm missing something, but then please explain a bit further what issue you have and what you want to achieve. Some sample data is always helpful for improving our understanding of your question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@FrankVl wrote:IPv6 is a completely different addressing scheme than IPv4. You can't translate IPv6 addresses to IPv4 addresses.
In this instance im 99.999% sure he's talking about IPv4 in IPv6 and converting it back to IPv4. So Yes. But no. We're dealing with this right now (we're are borg, you will be assimilated). IPv6 is not IPv4 but IPv6 can encapsulate (thats the word i chose, deal with it 😄 ) IPv4. Salesforce does this. You get something like ...
0000:0000:0000:0000:0000:ffff:abcd:ef01
in this example ab is first octet, cd is second, ef is third, and 01 is fourth. you have a couple of options for dealing with this but all of them start with an extract of the octets and then involve an EVAL- that puts them back together. The only difference is that instead of doing a tonumber() repeatedly, you could add the option of using a lookup table instead which may save some processing power for LISPY (or not given all the extra steps; i have no idea).
The easiest option after EXTRACTing out the octets is...
EVAL-ipaddr = tonumber(hex_value, oct1)+"."+tonumber(hex_value, oct2)+"."+tonumber(hex_value, oct3)+"."tonumber(hex_value, oct4)
If someone has a better way, i'd love to hear it. If not please accept this answer so i get coolness points.
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
Adoption of RUM and APM at Splunk
