Splunk Search

How to convert SHA1 value to integer with base 16?

aps
New Member

Hi ,,

i am looking for the way if i could convert sha1 value to integer with base 16 to do the further arithmetic operations on it using eval. 

i tried :

..... |eval sha=sha1("xyz123")|eval dec_number=tonumber(sha,16)

but dec_number is returning nothing. Could anyone suggest something ?

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A SHA1 value would be an integer too big to represent in 64 bits, which probably is why tonumber fails.

What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.
0 Karma

aps
New Member

Hi @richgalloway 

i need to filter some events based on "string SHA1" > decimal[16] integer value's mode operations. 

Something like -    
(SHA_Value.to_interger(16) % 100

i was checking if i could achieve it by using "tonumber" function with eval for mode operation. if you could suggest some other method or trick would be appreciated. 

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

As @richgalloway indicates, the problem is the scale of SHA1 that SPL cannot handle.  I did some test, and uncovered extremely buggy behavior when an integer approaches and exceeds 10 trillion, or 10^13. (What are limitations of numeric calculation/representations?)  In comparison, SHA1 is 40 digits HEX.  Your best bet is an external command.

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...