Splunk Search

How to convert an IP address to binary?

Applegreengrape
Explorer

I need to convert an IP address to binary.

i.e. IP Address:10.171.230.151
-->10 171 230 151
-->11000000101010000000010100000000
finally it is a 32 digit binary

How can I do it with a Splunk search?

thanks

Tags (4)
1 Solution

javiergn
Super Champion

Hi,

Shouldn't 10.171.230.151 be represented in binary as

00001010 . 10101011 . 11100110 . 10010111

In any case, if that is what you are trying to achieve, see if the following code helps:

| stats count
| fields - count
| eval IP = "10.171.230.151"
| eval octet = split(IP, ".")
| eval rank = split("1,2,3,4", ",")
| eval octet_rank = mvzip(rank, octet)
| fields - octet, rank
| mvexpand octet_rank
| eval octet_rank_split = split(octet_rank, ",")
| eval rank = mvindex(octet_rank_split, 0)
| eval octet = mvindex(octet_rank_split, 1)
| fields - octet_rank, octet_rank_split
| eval power = mvrange(0,8)
| mvexpand power
| eval base2 = pow(2, power)
| eval mydiv = floor(octet / base2)
| eval octet_bin = mydiv % 2
| fields - mydiv, base2
| sort limit=0 IP, rank, octet, - power
| stats list(octet_bin) as octet_bin by IP, rank, octet
| eval octet_bin = mvjoin(octet_bin, "")
| sort limit=0 IP, rank
| stats list(octet_bin) as octet_bin by IP
| eval octet_bin = mvjoin(octet_bin, ".")

Output:

IP  octet_bin
10.171.230.151  00001010.10101011.11100110.10010111 

I did answer something similar in the past in case that helps too:

https://answers.splunk.com/answers/342277/is-it-possible-to-perform-bitwise-operations-on-va.html

Thanks,
J

View solution in original post

javiergn
Super Champion

Hi,

Shouldn't 10.171.230.151 be represented in binary as

00001010 . 10101011 . 11100110 . 10010111

In any case, if that is what you are trying to achieve, see if the following code helps:

| stats count
| fields - count
| eval IP = "10.171.230.151"
| eval octet = split(IP, ".")
| eval rank = split("1,2,3,4", ",")
| eval octet_rank = mvzip(rank, octet)
| fields - octet, rank
| mvexpand octet_rank
| eval octet_rank_split = split(octet_rank, ",")
| eval rank = mvindex(octet_rank_split, 0)
| eval octet = mvindex(octet_rank_split, 1)
| fields - octet_rank, octet_rank_split
| eval power = mvrange(0,8)
| mvexpand power
| eval base2 = pow(2, power)
| eval mydiv = floor(octet / base2)
| eval octet_bin = mydiv % 2
| fields - mydiv, base2
| sort limit=0 IP, rank, octet, - power
| stats list(octet_bin) as octet_bin by IP, rank, octet
| eval octet_bin = mvjoin(octet_bin, "")
| sort limit=0 IP, rank
| stats list(octet_bin) as octet_bin by IP
| eval octet_bin = mvjoin(octet_bin, ".")

Output:

IP  octet_bin
10.171.230.151  00001010.10101011.11100110.10010111 

I did answer something similar in the past in case that helps too:

https://answers.splunk.com/answers/342277/is-it-possible-to-perform-bitwise-operations-on-va.html

Thanks,
J

Applegreengrape
Explorer

wow good stuff! I will definitely try it! thannnnnks!
≧❂◡❂≦

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...