Splunk Search

## How to convert hexadecimal IP to decimal

Builder

Hello all,
How can we convert this to regular IP?
I tried using the below search but it's not converting correctly.
Below is the sample event:

``````| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16))
``````

SYMNP-SMI::enterprises."9.9.42.1.3.2.1.8.13.3197256382.1.1" = "0x0aa0a04b"

Tags (4)
1 Solution
Builder

here is the solution.

``````| makeresults
| eval _raw="SYMNP-SMI::enterprises.\"9.9.42.1.3.2.1.8.13.3197256382.1.1\" = \"0x0aa0a04b\""
| rex "0x(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16))
``````
Builder

here is the solution.

``````| makeresults
| eval _raw="SYMNP-SMI::enterprises.\"9.9.42.1.3.2.1.8.13.3197256382.1.1\" = \"0x0aa0a04b\""
| rex "0x(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16))
``````
Builder

Thank you very much @poete

Get Updates on the Splunk Community!

#### Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

#### Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

#### .conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...