Comments and answers for "Is it possible to perform bitwise operations on values in the eval function?"
https://answers.splunk.com/answers/342277/is-it-possible-to-perform-bitwise-operations-on-va.html
The latest comments and answers for the question "Is it possible to perform bitwise operations on values in the eval function?"Comment by whisperstream on whisperstream's comment
https://answers.splunk.com/comments/342376/view.html
Wow, thanks for this, amazing how much work it is for such a basic operation, hopefully someone from Splunk will take notice and add the features to the both eval and stats functions.Thu, 14 Jan 2016 16:04:38 GMTwhisperstreamComment by javiergn on javiergn's answer
https://answers.splunk.com/comments/342371/view.html
Example with 3 numbers (x, y, w):
| stats count
| fields - count
| eval x = 19
| eval power = mvrange(0,21)
| mvexpand power
| eval base2 = pow(2, power)
| where x >= base2
| eval mydiv = floor(x / base2)
| eval mybin = mydiv % 2
| eval binx = mybin
| appendcols [
| stats count
| fields - count
| eval y = 3
| eval power = mvrange(0,20)
| mvexpand power
| eval base2 = pow(2, power)
| where y >= base2
| eval mydiv = floor(y / base2)
| eval mybin = mydiv % 2
| eval biny = mybin
]
| appendcols [
| stats count
| fields - count
| eval w = 1
| eval power = mvrange(0,20)
| mvexpand power
| eval base2 = pow(2, power)
| where w >= base2
| eval mydiv = floor(w / base2)
| eval mybin = mydiv % 2
| eval binw = mybin
]
| fillnull
| eval bitwiseOr = round((binx + biny) / 2)
| eval bitwiseOr = round((bitwiseOr + binw) / 2)
| eval bitwiseAnd = (binx * biny * binw)
| eval zAnd = bitwiseAnd * base2
| eval zOr = bitwiseOr * base2
| stats max(x) as x, max(y) as y, max(w) as w, list(binx) as binx, list(biny) as biny, list(binw) as binw, list(bitwiseOr) as bitwiseOr, list(bitwiseAnd) as bitwiseAnd, sum(zAnd) as zAnd, sum(zOr) as zOrThu, 14 Jan 2016 15:49:20 GMTjaviergnComment by javiergn on javiergn's answer
https://answers.splunk.com/comments/342358/view.html
I have edited the above a couple of times:
**EDIT1: to use your naming convention.
EDIT2: also calculating Z back at the bottom
EDIT3: quick performance improvements and now you don't have to specify X and Y twice**Thu, 14 Jan 2016 15:15:01 GMTjaviergnAnswer by javiergn
https://answers.splunk.com/answering/342322/view.html
You could write your command in Python. See [this][1] and [this][2]
Alternatively, try the following query I've written as I was really curious on how to achieve this from Splunk. The logic should work fine if you have more than 2 numbers, simply use another appendcols and play with the bitwise variables. This works with numbers up to 2^20 - 1, simply increase all the mvrange parameters if you want it to be able to cope with bigger numbers.
**EDIT1: to use your naming convention.**
**EDIT2: also calculating Z back at the bottom**
**EDIT3: quick performance improvements and now you don't have to specify X and Y twice**
| stats count
| fields - count
| eval x = 63
| eval power = mvrange(0,20)
| mvexpand power
| eval base2 = pow(2, power)
| where x >= base2
| eval mydiv = floor(x / base2)
| eval mybin = mydiv % 2
| eval binx = mybin
| appendcols [
| stats count
| fields - count
| eval y = 2
| eval power = mvrange(0,20)
| mvexpand power
| eval base2 = pow(2, power)
| where y >= base2
| eval mydiv = floor(y / base2)
| eval mybin = mydiv % 2
| eval biny = mybin
]
| fillnull
| eval bitwiseOr = round((binx + biny) / 2)
| eval bitwiseAnd = (binx * biny)
| eval zAnd = bitwiseAnd * base2
| eval zOr = bitwiseOr * base2
| stats max(x) as x, max(y) as y, list(binx) as binx, list(biny) as biny, list(bitwiseOr) as bitwiseOr, list(bitwiseAnd) as bitwiseAnd, sum(zAnd) as zAnd, sum(zOr) as zOr
And this is the result (see picture below):
![alt text][3]
[1]: http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
[2]: https://answers.splunk.com/answers/301449/why-is-my-custom-search-command-not-producing-expe.html
[3]: /storage/temp/81196-bitwiseresult2.pngThu, 14 Jan 2016 11:40:44 GMTjaviergn