The above eval statement does not correctly convert 0 to 0.0.0.0 and null values. Try this: Note: replace ip with the field name you would like to convert. | eval o1=floor(ip/16777216) | eval o2=floor((ip-o1*16777216)/65536) | eval o3=floor((ip-(o1*16777216+o2*65536))/256)| eval o4=ip-(o1*16777216+o2*65536+o3*256) | eval ipv4=tostring(o1)+"."+tostring(o2)+"."+tostring(o3)+"."+tostring(o4) | eval ipv4=if(ipv4="Null.Null.Null.Null","",ipv4)
... View more