Splunk Search

tonumber Not Working?


I have windows logs and I have extracted the Process ID's and Login ID's. I thought the | eval tonumber would work but it doesn't return anything.

In this example my Login Id is 0x29019c75

index=charlesriver sourcetype="windows_events" WindowsLogonID=0x29019c75 | eval WindowsLoginID=tonumber(WindowsLoginID) | table _time ADLogon WindowsLoginID | sort -WindowsLoginID

(In case you are asking why, we are comparing the login id to what is logged in an application log)

Tags (1)
0 Karma

Revered Legend

The WindowsLoginID field is represented in Hex format so use following. (see tonumber)

index=charlesriver sourcetype="windows_events"   WindowsLogonID=0x29019c75 | eval WindowsLoginID=tonumber(WindowsLoginID,16)  | table  _time ADLogon WindowsLoginID  | sort  -WindowsLoginID
0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...