I am extracting a field "ipaddr" which is the result of using "eval" to convert a previously extracted field "nwclient_ip_hex" (IP address in hexadecimal, for example "a0b0c0d0") to decimal. The snippet below works fine in the Search app.
How can I save "ipaddr" as a field so that other users of the app will be able to use it without needing all of that logic in the search bar?
... |eval d1 = tonumber(substr(nwclient_ip_hex,1,2),16) |eval d2 = tonumber(substr(nwclient_ip_hex,3,2),16) |eval d3 = tonumber(substr(nwclient_ip_hex,5,2),16) |eval d4 = tonumber(substr(nwclient_ip_hex,7,2),16) |eval ipaddr = d1+"."+d2+"."+d3+"."+d4
Thanks - Andy
As of version 4.2.4, there is no way to do this. Search-time field extractions can only be simple substrings of the indexed data. You could encapsulate this logic in a macro, so the user sees less of the logic:
... | `convert_to_ip(nwclient_ip_hex)`
Where convert_to_ip()
is defined as a macro that does the above. The user will still have to see the invocation of the macro, however.
As of version 4.2.4, there is no way to do this. Search-time field extractions can only be simple substrings of the indexed data. You could encapsulate this logic in a macro, so the user sees less of the logic:
... | `convert_to_ip(nwclient_ip_hex)`
Where convert_to_ip()
is defined as a macro that does the above. The user will still have to see the invocation of the macro, however.
gkanapathy, any way to do this in 4.3 or 5.0?