Splunk Search

How to convert indexed IP data from hex to decimal format in Splunk?

Path Finder

Hi there, How do you convert IP addresses from Hex to the normal IP format in Splunk?
Right now they're showing up as "A1B2C3D4".

I would like them to show up in the form 192.168.1.1?

Tags (3)
1 Solution

SplunkTrust
SplunkTrust

Hi splunknewby,

there is no build in function to do that, but you can use some tricks to get there. Try this:

your base search here 
| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) |...

The regex must be most likely adopted to your real life events, but it should give you an idea how to do it.

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi splunknewby,

there is no build in function to do that, but you can use some tricks to get there. Try this:

your base search here 
| rex "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) |...

The regex must be most likely adopted to your real life events, but it should give you an idea how to do it.

cheers, MuS

View solution in original post

Path Finder

Thanks Mus, that did the trick. How do I make it so that any further searches I do has the IP addresses in this form rather than the HEX?

Where do I configure this?

0 Karma

SplunkTrust
SplunkTrust

you could use field extraction http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX to get d1,d2,d3,d4 as fields and a lookup table to translate the d fields into numbers .... this is the most you could probably do or change the source output to be decimal 😉

Path Finder

Cheers, thanks again 🙂

0 Karma

Path Finder

I tried using
rex "(?i)0x(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})(?[0-9A-F]{2})"
| eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) | geoip ip

from the answer given here:
http://answers.splunk.com/answers/27475/convert-hexadecimal-ip-v4-addresses-to-decimal.html
but splunk is showing the following "Unknown search command 'geoip'."

0 Karma