In the tradition of Splunk's iplocation command, this is a Splunk command called ip2decimal that returns a decimal notation for all your IP data in your events. A new field called ipdecimal is returned. Usage: | ip2decimal Example: sourcetype=access_common|ip2decimal|table ip, ipdecimal Note that you must have ip address(es) in your events for the ipdecimal field to exist in your results. The addresses are extracted at search time via a built in regex for the command. Read the README.txt for installation.