Hello Experts,
I have a field called "src" which contains IP addresses in decimal format but I want to change the format to IPv4. I have an eval as mentioned below:
WORKS FINE FOR INLINE SEARCH
eval remainder=src | eval firstoctet=floor(remainder/pow(256,3)) | eval remainder=remainder-(firstoctet*pow(256,3)) | eval secondoctet=floor(remainder/pow(256,2)) | eval remainder=remainder-secondoctet*pow(256,2) | eval thirdoctet=floor(remainder/pow(256,1)) | eval remainder=remainder-thirdoctet*pow(256,1) | eval src_ip=firstoctet+"."+secondoctet+"."+thirdoctet+"."+remainder
DOESN'T WORK FINE WHEN USED IN PROPS.CONF
eval-remainder=src | eval firstoctet=floor(remainder/pow(256,3)) | eval remainder=remainder-(firstoctet*pow(256,3)) | eval secondoctet=floor(remainder/pow(256,2)) | eval remainder=remainder-secondoctet*pow(256,2) | eval thirdoctet=floor(remainder/pow(256,1)) | eval remainder=remainder-thirdoctet*pow(256,1) | eval src_ip=firstoctet+"."+secondoctet+"."+thirdoctet+"."+remainder
Help required. Thanks in advance.
↧