int_to_ip ↗

Use the int_to_ip() function to convert a signed integer representation of an IPv4 address into its standard dotted-decimal string equivalent.

Syntax

int_to_ip(<IPv4_integer>)

Parameters

Name Type Required Description
IPv4_integer integer Yes The integer value that represents an IPv4 address.

Returns

The int_to_ip() function returns the corresponding IPv4 address as a string.

Usage notes

  • This function is the inverse of the ip_to_int() function, which converts a string representation of an IPv4 address to an integer.
  • The function safely handles signed integers, meaning it can process both positive and negative integer inputs to produce valid IP address strings.
  • Ideally, this function is utilized within the alter stage to create new fields or modify existing ones based on the converted IP address.

Examples

Example 1: Convert standard positive integer to IPv4

Goal: Convert a standard positive integer representing an IPv4 address to its dotted-decimal string form.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter converted_ip = int_to_ip(75643532) 
| fields event_id, converted_ip 
| limit 3

Explanation: The query creates a new field converted_ip by converting the integer 75643532 to its IPv4 string equivalent, which is "4.130.58.140".

Output:

EVENT_ID CONVERTED_IP
101 4.130.58.140
102 4.130.58.140
103 4.130.58.140

Example 2: Convert negative integer to IPv4

Goal: Convert a negative integer, which represents an IPv4 address in a different byte order, to its corresponding dotted-decimal string.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter converted_ip = int_to_ip(-75643532) 
| fields event_id, converted_ip 
| limit 3

Explanation: The query creates a new field converted_ip by converting the integer -75643532 to its IPv4 string equivalent, which is "251.125.197.116".

Output:

EVENT_ID CONVERTED_IP
101 251.125.197.116
102 251.125.197.116
103 251.125.197.116

Example 3: Convert zero to IPv4

Goal: Convert the integer 0 to its IPv4 address string representation.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter converted_ip = int_to_ip(0) 
| fields event_id, converted_ip 
| limit 3

Explanation: The query creates converted_ip by converting 0 to its IPv4 string equivalent, "0.0.0.0".

Output:

EVENT_ID CONVERTED_IP
101 0.0.0.0
102 0.0.0.0
103 0.0.0.0

Example 4: Convert large positive integer to IPv4 (broadcast address)

Goal: Convert the maximum unsigned 32-bit integer to its IPv4 address string representation, which corresponds to the broadcast address.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter converted_ip = int_to_ip(4294967295) // Converts the integer 4294967295 (2^32 - 1) to an IPv4 address
| fields event_id, converted_ip 
| limit 3

Explanation: The query creates a new field converted_ip by converting the integer 4294967295 (which is ) to its IPv4 string equivalent, "255.255.255.255".

Output:

EVENT_ID CONVERTED_IP
101 255.255.255.255
102 255.255.255.255
103 255.255.255.255