Splunk Search

How to convert indexed IP data from hex to decimal format in Splunk?

splunknewby
Path Finder

Hi there, How do you convert IP addresses from Hex to the normal IP format in Splunk?
Right now they're showing up as "A1B2C3D4".

I would like them to show up in the form 192.168.1.1?

Tags (3)
1 Solution

MuS
Legend

Hi splunknewby,

there is no build in function to do that, but you can use some tricks to get there. Try this:

your base search here 
| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) |...

The regex must be most likely adopted to your real life events, but it should give you an idea how to do it.

cheers, MuS

View solution in original post

MuS
Legend

Hi splunknewby,

there is no build in function to do that, but you can use some tricks to get there. Try this:

your base search here 
| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) |...

The regex must be most likely adopted to your real life events, but it should give you an idea how to do it.

cheers, MuS

splunknewby
Path Finder

Thanks Mus, that did the trick. How do I make it so that any further searches I do has the IP addresses in this form rather than the HEX?

Where do I configure this?

0 Karma

MuS
Legend

you could use field extraction http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX to get d1,d2,d3,d4 as fields and a lookup table to translate the d fields into numbers .... this is the most you could probably do or change the source output to be decimal 😉

splunknewby
Path Finder

Cheers, thanks again 🙂

0 Karma

splunknewby
Path Finder

I tried using
rex "(?i)0x(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) | geoip ip

from the answer given here:
http://answers.splunk.com/answers/27475/convert-hexadecimal-ip-v4-addresses-to-decimal.html
but splunk is showing the following "Unknown search command 'geoip'."

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...