Splunk Search

## How to convert an IP address to binary?

Explorer

I need to convert an IP address to binary.

-->10 171 230 151
-->11000000101010000000010100000000
finally it is a 32 digit binary

How can I do it with a Splunk search?

thanks

Tags (4)
1 Solution
Super Champion

Hi,

Shouldn't 10.171.230.151 be represented in binary as

``````00001010 . 10101011 . 11100110 . 10010111
``````

In any case, if that is what you are trying to achieve, see if the following code helps:

``````| stats count
| fields - count
| eval IP = "10.171.230.151"
| eval octet = split(IP, ".")
| eval rank = split("1,2,3,4", ",")
| eval octet_rank = mvzip(rank, octet)
| fields - octet, rank
| mvexpand octet_rank
| eval octet_rank_split = split(octet_rank, ",")
| eval rank = mvindex(octet_rank_split, 0)
| eval octet = mvindex(octet_rank_split, 1)
| fields - octet_rank, octet_rank_split
| eval power = mvrange(0,8)
| mvexpand power
| eval base2 = pow(2, power)
| eval mydiv = floor(octet / base2)
| eval octet_bin = mydiv % 2
| fields - mydiv, base2
| sort limit=0 IP, rank, octet, - power
| stats list(octet_bin) as octet_bin by IP, rank, octet
| eval octet_bin = mvjoin(octet_bin, "")
| sort limit=0 IP, rank
| stats list(octet_bin) as octet_bin by IP
| eval octet_bin = mvjoin(octet_bin, ".")
``````

Output:

``````IP  octet_bin
10.171.230.151  00001010.10101011.11100110.10010111
``````

I did answer something similar in the past in case that helps too:

Thanks,
J

Super Champion

Hi,

Shouldn't 10.171.230.151 be represented in binary as

``````00001010 . 10101011 . 11100110 . 10010111
``````

In any case, if that is what you are trying to achieve, see if the following code helps:

``````| stats count
| fields - count
| eval IP = "10.171.230.151"
| eval octet = split(IP, ".")
| eval rank = split("1,2,3,4", ",")
| eval octet_rank = mvzip(rank, octet)
| fields - octet, rank
| mvexpand octet_rank
| eval octet_rank_split = split(octet_rank, ",")
| eval rank = mvindex(octet_rank_split, 0)
| eval octet = mvindex(octet_rank_split, 1)
| fields - octet_rank, octet_rank_split
| eval power = mvrange(0,8)
| mvexpand power
| eval base2 = pow(2, power)
| eval mydiv = floor(octet / base2)
| eval octet_bin = mydiv % 2
| fields - mydiv, base2
| sort limit=0 IP, rank, octet, - power
| stats list(octet_bin) as octet_bin by IP, rank, octet
| eval octet_bin = mvjoin(octet_bin, "")
| sort limit=0 IP, rank
| stats list(octet_bin) as octet_bin by IP
| eval octet_bin = mvjoin(octet_bin, ".")
``````

Output:

``````IP  octet_bin
10.171.230.151  00001010.10101011.11100110.10010111
``````

I did answer something similar in the past in case that helps too:

Thanks,
J

Explorer

wow good stuff! I will definitely try it! thannnnnks!
≧❂◡❂≦

Get Updates on the Splunk Community!

#### Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

#### Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

#### Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...