How to convert 64-bit number from decimal to hex

[helge]

I would like to convert 64-bit numbers stored as decimal integers to a hexadecimal representation.
I am aware of the eval command tostring(dec, "hex"). It works well enough but seems to be limited to 32-bit integers.

Example: tostring(140726995023972, "hex") gives me 0x8E8C7864. The correct result would be 0x7FFD8E8C7864.

My question: is this documented?

I found this on Splunk 6.5.3 on Windows.

[niketn · Accepted solution]

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864

[helge]

I can confirm the workaround works on Splunk 6.6.3 on Windows, too.

[niketn]

@helge, if the workaround has helped you resolve your issue, can you Accept the Answer?

[helge]

Thanks for your answer. I would love to report this to Splunk Support, however, as a lowly Splunk Technology Partner, I do not have a support entitlement.

[niketn]

😄 ... I have added it to the list of paint points of Splunk Deployment on Windows OS maintained posted by @woodcock: https://answers.splunk.com/answers/516059/what-are-the-pain-points-with-deploying-your-splun.html?pa...

Please try out the printf() command for 64 bit integer to hex conversion and confirm if it works for you on Windows.

[inventsekar]

that is a good catch. just for our reference, i am on splunk 6.3.4 on linux, it works fine.

| makeresults | eval number=140726995023972 | eval newnumber = tostring(140726995023972, "hex") |  table number newnumber 

PS - tried to post as a comment, but comment wont allow photos upload, thus posting it as a answer.

[helge]

Thanks for verifying on a different platform. I tried your exact search, too, and it confirms my findings. On Windows 6.5.3 it gives me the clipped 0x8E8C7864.

[inventsekar]

just a thought - is your windows running on 32 bit or 64 bit?

[helge]

I am running 64-bit Splunk on 64-bit Windows Server 2012 R2.