I'd create a lookup:
| makeresults count=65536
| streamstats c
| eval value_dec=tostring(c-1)
| eval value_0xhex=tostring((c-1), "hex")
| eval value_hex=replace(value_0xhex, "^0x", "")
| eval value_bin=value_hex
| rex mode=sed field=value_bin "s/0/0000/g s/1/0001/g s/2/0010/g s/3/0011/g s/4/0100/g s/5/0101/g s/6/0110/g s/7/0111/g s/8/1000/g s/9/1001/g s/a|A/1010/g s/b|B/1011/g s/c|C/1100/g s/d|D/1101/g s/e|E/1110/g s/f|F/1111/g"
| eval value_bin=substr("0000000000000000", 0, max(16-len(value_bin), 0)) . value_bin
| rex field=value_bin "(?<bit__15>.)(?<bit__14>.)(?<bit__13>.)(?<bit__12>.)(?<bit__11>.)(?<bit__10>.)(?<bit__09>.)(?<bit__08>.)(?<bit__07>.)(?<bit__06>.)(?<bit__05>.)(?<bit__04>.)(?<bit__03>.)(?<bit__02>.)(?<bit__01>.)(?<bit__00>.)"
| table value_dec value_hex value_0xhex value_bin bit__*
| outputlookup convert_value.csv
And then use this lookup to convert any number to any radix and have all my bits automatically extracted:
| makeresults count=111 | streamstats c
| lookup convert_value.csv value_dec AS c | table c value_* bit__*
Resulted lookup (even for 65536 values) is <5MB and will work really fast. You can make it even faster by generating smaller lookup table (if you don't need all 16 bits)
... View more
