Splunk Search
Highlighted

How to convert a decimal into binary?

Champion

There doesn't seem to be command that will magically convert my decimal into binary. Any tips on how this can be done?

0 Karma
Highlighted

Re: How to convert a decimal into binary?

Champion

Here's one example, assuming your decimal field is named "RAW_VALUE"

search RAW_VALUE=* 
| stats latest(RAW_VALUE) as RAW_VALUE by host 
| eval power=mvrange(0,20) | mvexpand power | eval base2=pow(2, power) 
| where RAW_VALUE>=base2 
| eval mydiv=floor(RAW_VALUE/base2) 
| eval mybin=mydiv % 2 
| sort - power 
| stats list(mybin) as binary by host,RAW_VALUE

This is built off of hints from the comment by javiergn in the following post: https://answers.splunk.com/answers/342277/is-it-possible-to-perform-bitwise-operations-on-va.html

View solution in original post

Highlighted

Re: How to convert a decimal into binary?

Influencer
... | eval binary=replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr(tostring(mynumber, "hex"), 3), "0", "0000"), "1", "0001"), "2", "0010"), "3", "0011"), "4", "0100"), "5", "0101"), "6", "0110"), "7", "0111"), "8", "1000"), "9", "1001"), "A", "1010"), "B", "1011"), "C", "1100"), "D", "1101"), "E", "1110"), "F", "1111")
Highlighted

Re: How to convert a decimal into binary?

SplunkTrust
SplunkTrust

Upvote for much less crazy than the alternatives.

0 Karma
Highlighted

Re: How to convert a decimal into binary?

SplunkTrust
SplunkTrust

Slightly more readable for the same function...

| makeresults | eval RAW_VALUE=mvappend("2531","11","5") | mvexpand RAW_VALUE  
| rename COMMENT as "The above just makes test data"

| eval binary=tostring(RAW_VALUE,"hex")
| rex mode=sed field=binary "s/0/0000/g s/1/0001/g s/2/0010/g s/3/0011/g s/4/0100/g s/5/0101/g s/6/0110/g s/7/0111/g s/8/1000/g s/9/1001/g s/a|A/1010/g s/b|B/1011/g s/c|C/1100/g s/d|D/1101/g s/e|E/1110/g s/f|F/1111/g s/x// s/^0//g" 
0 Karma