tonumber Not Working?

[andrewkenth]

I have windows logs and I have extracted the Process ID's and Login ID's. I thought the | eval tonumber would work but it doesn't return anything.

In this example my Login Id is 0x29019c75

index=charlesriver sourcetype="windows_events" WindowsLogonID=0x29019c75 | eval WindowsLoginID=tonumber(WindowsLoginID) | table _time ADLogon WindowsLoginID | sort -WindowsLoginID

(In case you are asking why, we are comparing the login id to what is logged in an application log)

[somesoni2]

The WindowsLoginID field is represented in Hex format so use following. (see tonumber)

index=charlesriver sourcetype="windows_events"   WindowsLogonID=0x29019c75 | eval WindowsLoginID=tonumber(WindowsLoginID,16)  | table  _time ADLogon WindowsLoginID  | sort  -WindowsLoginID