Dashboards & Visualizations

How to convert 64-bit number from decimal to hex

helge
Builder

I would like to convert 64-bit numbers stored as decimal integers to a hexadecimal representation.
I am aware of the eval command tostring(dec, "hex"). It works well enough but seems to be limited to 32-bit integers.

Example: tostring(140726995023972, "hex") gives me 0x8E8C7864. The correct result would be 0x7FFD8E8C7864.

My question: is this documented?

I found this on Splunk 6.5.3 on Windows.

0 Karma
1 Solution

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

@helge, I tested on Splunk Enterprise 7.0 on Windows 10 64 bit and can see the issue with tostring(64bitInteger,"hex") converting to 32 bit Hexadecimal number. Please add a bug tag to your question and report the same to Splunk Support through your Splunk Entitlement.

Workaround: Try using printf() command, with argument as %X, to convert to 64-bit hexadecimal.

Following is the run anywhere search:

|  makeresults
|  eval data="140726995023972"
|  eval dataHexUsingTostring=tostring(140726995023972, "hex")
|  eval dataHexUsingPrintf=printf("%X",data)
|  table data dataHexUsingTostring dataHexUsingPrintf

Following is the output:

data               dataHexUsingTostring dataHexUsingPrintf
140726995023972 0x8E8C7864            7FFD8E8C7864
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

helge
Builder

I can confirm the workaround works on Splunk 6.6.3 on Windows, too.

@helge, if the workaround has helped you resolve your issue, can you Accept the Answer?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

helge
Builder

Thanks for your answer. I would love to report this to Splunk Support, however, as a lowly Splunk Technology Partner, I do not have a support entitlement.

0 Karma

😄 ... I have added it to the list of paint points of Splunk Deployment on Windows OS maintained posted by @woodcock: https://answers.splunk.com/answers/516059/what-are-the-pain-points-with-deploying-your-splun.html?pa...

Please try out the printf() command for 64 bit integer to hex conversion and confirm if it works for you on Windows.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

inventsekar
Super Champion

that is a good catch. just for our reference, i am on splunk 6.3.4 on linux, it works fine.

| makeresults | eval number=140726995023972 | eval newnumber = tostring(140726995023972, "hex") |  table number newnumber 

PS - tried to post as a comment, but comment wont allow photos upload, thus posting it as a answer.

alt text

>>> Happy Splunking !
0 Karma

helge
Builder

Thanks for verifying on a different platform. I tried your exact search, too, and it confirms my findings. On Windows 6.5.3 it gives me the clipped 0x8E8C7864.

0 Karma

inventsekar
Super Champion

just a thought - is your windows running on 32 bit or 64 bit?

>>> Happy Splunking !
0 Karma

helge
Builder

I am running 64-bit Splunk on 64-bit Windows Server 2012 R2.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...