Splunk Search

## How to convert a decimal into binary? Champion

There doesn't seem to be command that will magically convert my decimal into binary. Any tips on how this can be done?

Tags (5)
1 Solution Champion

Here's one example, assuming your decimal field is named "RAW_VALUE"

``````search RAW_VALUE=*
| stats latest(RAW_VALUE) as RAW_VALUE by host
| eval power=mvrange(0,20) | mvexpand power | eval base2=pow(2, power)
| where RAW_VALUE>=base2
| eval mydiv=floor(RAW_VALUE/base2)
| eval mybin=mydiv % 2
| sort - power
| stats list(mybin) as binary by host,RAW_VALUE
``````

This is built off of hints from the comment by javiergn in the following post: https://answers.splunk.com/answers/342277/is-it-possible-to-perform-bitwise-operations-on-va.html  Splunk Employee

Here is a simple, single eval that does it. Extend or reduce as required.

``````| makeresults count=32
| streamstats count as decimal
| eval decimal=decimal-1
| fields - _time

| eval binary=
floor(decimal/256%2).
floor(decimal/128%2).
floor(decimal/64%2).
floor(decimal/32%2).
floor(decimal/16%2).
floor(decimal/8%2).
floor(decimal/4%2).
floor(decimal/2%2).
floor(decimal/1%2)`````` Influencer
``````... | eval binary=replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(tostring(mynumber, "hex"), 3), "0", "0000"), "1", "0001"), "2", "0010"), "3", "0011"), "4", "0100"), "5", "0101"), "6", "0110"), "7", "0111"), "8", "1000"), "9", "1001"), "A", "1010"), "B", "1011"), "C", "1100"), "D", "1101"), "E", "1110"), "F", "1111")
``````  SplunkTrust

Upvote for much less crazy than the alternatives.  SplunkTrust

Slightly more readable for the same function...

``````| makeresults | eval RAW_VALUE=mvappend("2531","11","5") | mvexpand RAW_VALUE
| rename COMMENT as "The above just makes test data"

| eval binary=tostring(RAW_VALUE,"hex")
| rex mode=sed field=binary "s/0/0000/g s/1/0001/g s/2/0010/g s/3/0011/g s/4/0100/g s/5/0101/g s/6/0110/g s/7/0111/g s/8/1000/g s/9/1001/g s/a|A/1010/g s/b|B/1011/g s/c|C/1100/g s/d|D/1101/g s/e|E/1110/g s/f|F/1111/g s/x// s/^0//g"
`````` Champion

Here's one example, assuming your decimal field is named "RAW_VALUE"

``````search RAW_VALUE=*
| stats latest(RAW_VALUE) as RAW_VALUE by host
| eval power=mvrange(0,20) | mvexpand power | eval base2=pow(2, power)
| where RAW_VALUE>=base2
| eval mydiv=floor(RAW_VALUE/base2)
| eval mybin=mydiv % 2
| sort - power
| stats list(mybin) as binary by host,RAW_VALUE
``````

This is built off of hints from the comment by javiergn in the following post: https://answers.splunk.com/answers/342277/is-it-possible-to-perform-bitwise-operations-on-va.html Get Updates on the Splunk Community!