Splunk Search

How to convert an IP address in hex format to a normal IP address?

srinathd
Contributor

How do I convert an IP address in hex format "00000000000000000000FFFF0A15856E" into a normal dotted IP address

I tried like this, but it is not giving correct address:

| eval x="00000000000000000000FFFF0A15856E" | eval IP_ADDR1=tonumber(x,16) | table IP_ADDR1 | eval firstoctet = floor(IP_ADDR1/pow(256,3)) |
eval IP_ADDR1 = IP_ADDR1-(firstoctet*pow(256,3)) |
eval secondoctet = floor(IP_ADDR1/pow(256,2)) | 
eval IP_ADDR1 = IP_ADDR1-secondoctet*pow(256,2) | 
eval thirdoctet = floor(IP_ADDR1/pow(256,1)) |
eval IP_ADDR1 = IP_ADDR1-thirdoctet*pow(256,1) |
eval SRC_IP = firstoctet+"."+secondoctet+"."+thirdoctet+"."+IP_ADDR1 | table SRC_IP
Tags (4)
0 Karma

somesoni2
Revered Legend

Seems like there are junk characters added. Give something like this a try, considering only last 8 characters to ip conversion

| gentimes start=-1 | eval Reason="00000000000000000000FFFF0A15856E" | table Reason| rex field=Reason "(?<d1>\S{2})(?<d2>\S{2})(?<d3>[0-9A-F]{2})(?<d4>\S{2})$"  | eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16))
0 Karma

erritesh17
Path Finder

As you asked a question to convert decimal ipaddress to normal ipaddress, you can use the following query and check it:

index=* or your base search here | rex "(?i)(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})" | eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) 
0 Karma

srinathd
Contributor

From database i am fetching ipaddress which is in binary format. so i have used HEX(ipaddr,16) to convert binary to HEX in database query. Then In splunk i am trying to convert this ipaddress to decimal.

0 Karma

jplumsdaine22
Influencer

That does not look like an IPv4 address - There should be only 8 hex digits in an IP address

0 Karma

srinathd
Contributor

From database i am fetching ipaddress which is in binary format. so i have used HEX(ipaddr,16) to convert binary to HEX in database query. Then In splunk i am trying to convert this ipaddress to decimal.

0 Karma