how to convert ip - Splunk Community

Splunk Search

Hi

How to convet ip ?

ex)
SRC_IP=-1234567890 ===>> SRC_IP=1.2.3.4

Try this:

| eval ipsi=-1978431425| eval ip=if(ipsi<1,ipsi+2147483648,ipsi) | eval aaa=floor(ip/16777216) | eval bbb=floor((ip-aaa*16777216)/65536) | eval ccc=floor((ip-(aaa*16777216+bbb*65536))/256)| eval ddd=ip-(aaa*16777216+bbb*65536+ccc*256) | eval ipv4=tostring(aaa)+"."+tostring(bbb)+"."+tostring(ccc)+"."+tostring(ddd) | table ipsi ip ipv4

Fixed. Always indent code blocks with 4 spaces

For some reason, something consumed the stars meaning multiply - so bbb65536 really means multiply bbb by 65536

Have a look at this question and its answers: http://splunk-base.splunk.com/answers/24841/how-i-can-know-splunks-method-or-function-name-inside-sp...

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...