Splunk Search

How to convert indexed IP data from hex to decimal format in Splunk?

splunknewby
Path Finder

Hi there, How do you convert IP addresses from Hex to the normal IP format in Splunk?
Right now they're showing up as "A1B2C3D4".

I would like them to show up in the form 192.168.1.1?

Tags (3)
1 Solution

MuS
Legend

Hi splunknewby,

there is no build in function to do that, but you can use some tricks to get there. Try this:

your base search here 
| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) |...

The regex must be most likely adopted to your real life events, but it should give you an idea how to do it.

cheers, MuS

View solution in original post

MuS
Legend

Hi splunknewby,

there is no build in function to do that, but you can use some tricks to get there. Try this:

your base search here 
| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) |...

The regex must be most likely adopted to your real life events, but it should give you an idea how to do it.

cheers, MuS

splunknewby
Path Finder

Thanks Mus, that did the trick. How do I make it so that any further searches I do has the IP addresses in this form rather than the HEX?

Where do I configure this?

0 Karma

MuS
Legend

you could use field extraction http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX to get d1,d2,d3,d4 as fields and a lookup table to translate the d fields into numbers .... this is the most you could probably do or change the source output to be decimal 😉

splunknewby
Path Finder

Cheers, thanks again 🙂

0 Karma

splunknewby
Path Finder

I tried using
rex "(?i)0x(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) | geoip ip

from the answer given here:
http://answers.splunk.com/answers/27475/convert-hexadecimal-ip-v4-addresses-to-decimal.html
but splunk is showing the following "Unknown search command 'geoip'."

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...