Save an 'eval'-based field extraction?

[andyspusm]

I am extracting a field "ipaddr" which is the result of using "eval" to convert a previously extracted field "nwclient_ip_hex" (IP address in hexadecimal, for example "a0b0c0d0") to decimal. The snippet below works fine in the Search app.

How can I save "ipaddr" as a field so that other users of the app will be able to use it without needing all of that logic in the search bar?

... |eval d1 = tonumber(substr(nwclient_ip_hex,1,2),16) |eval d2 = tonumber(substr(nwclient_ip_hex,3,2),16) |eval d3 = tonumber(substr(nwclient_ip_hex,5,2),16) |eval d4 = tonumber(substr(nwclient_ip_hex,7,2),16) |eval ipaddr = d1+"."+d2+"."+d3+"."+d4

Thanks - Andy

[gkanapathy · Accepted solution]

As of version 4.2.4, there is no way to do this. Search-time field extractions can only be simple substrings of the indexed data. You could encapsulate this logic in a macro, so the user sees less of the logic:

 ... | `convert_to_ip(nwclient_ip_hex)`

Where convert_to_ip() is defined as a macro that does the above. The user will still have to see the invocation of the macro, however.

[hulahoop]

gkanapathy, any way to do this in 4.3 or 5.0?