Splunk Search

How to convert hexadecimal IP to decimal

Builder

Hello all,
How can we convert this to regular IP?
I tried using the below search but it's not converting correctly.
Below is the sample event:

| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
 | eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16))

SYMNP-SMI::enterprises."9.9.42.1.3.2.1.8.13.3197256382.1.1" = "0x0aa0a04b"

0 Karma
1 Solution

Builder

Hello @vrmandadi,

here is the solution.

| makeresults 
| eval _raw="SYMNP-SMI::enterprises.\"9.9.42.1.3.2.1.8.13.3197256382.1.1\" = \"0x0aa0a04b\""
| rex "0x(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16))

View solution in original post

Builder

Hello @vrmandadi,

here is the solution.

| makeresults 
| eval _raw="SYMNP-SMI::enterprises.\"9.9.42.1.3.2.1.8.13.3197256382.1.1\" = \"0x0aa0a04b\""
| rex "0x(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16))

View solution in original post

Builder

Thank you very much @poete

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!