tohex

You typically use tohex when working with numeric identifiers, memory addresses, or when you need hexadecimal representation for debugging, logging, or system integration purposes.

Usage#

Syntax#

tohex(value [, minLength])

Parameters#

Name	Type	Description
value	int	The integer or long value to convert to hexadecimal string.
minLength	int	Optional. Minimum length of the resulting hex string. Default is 0.

Returns#

If conversion is successful, the result is a string value representing the hexadecimal representation. If conversion isn't successful, the result is null.

Example#

Convert numeric identifiers to hexadecimal format for display or integration with systems that use hex identifiers.

Query

['sample-http-logs']
| extend id_hex = tohex(id, 8)
| project _time, uri, id, id_hex

Output

_time	uri	id	id_hex
Jun 24, 09:28:10	/api/users	12345	00003039

This example converts numeric identifiers to hexadecimal format, making them more readable and compatible with systems that use hex identifiers.

toint: Converts input to integer. Use toint for smaller integers before converting to hex.
tostring: Converts input to string. Use tostring for general string conversion, and tohex specifically for hexadecimal representation.

Other query languages#

Splunk SPL users

In Splunk, you use printf with format specifiers like %x or %X to convert numbers to hexadecimal. In APL, tohex provides a direct function for this conversion.

Splunk example

... | eval hex_value = printf("%x", numeric_field)

APL equivalent

... | extend hex_value = tohex(numeric_field)

ANSI SQL users

In standard SQL, you use TO_HEX or HEX functions in some databases, or FORMAT functions with hex specifiers. In APL, tohex provides a straightforward way to convert integers to hexadecimal strings.

SQL example

SELECT TO_HEX(546) AS hex_value FROM dual;