Had to do this today because VPN logs for eStreamer returns the IPv4 client_ip field in hex encoded IPv6 format (e.g. 104.33.245.146 is listed as 0000:0000:0000:0000:0000:ffff:6821:f592) index=estreamer | eval A=if(like(client_ip,"0000:0000:0000:0000:0000:ffff:%"), substr(ipv6,31,9) , client_ip) | eval src_ip=if(len(A)==9, tonumber(substr(A,1,2),16). "." .tonumber(substr(A,3,2),16). "." .tonumber(substr(A,6,2),16). "." .tonumber(substr(A,8,2),16), A) Not sure what the use case OP originally was looking for, but hope this helps someone. First eval compares set temp variable A to the hex-encoded IPv4 if matches the format, otherwise stores the IPv6 Second eval parses & converts each IPv4 octet if A is 9 characters long, othewise returns the IPv6 Hope this helps someone else.     ... View more