FAQ: How do I convert decimal values to hexadecimal values?

You can use the select() and format() functions to convert decimal values to hexadecimal values.

logscale
#event_simpleName=UserLogonFailed2 event_platform=Win
| SubStatus_hex := format(field=SubStatus, "0x%X")
| select([@timestamp, aid, UserName, LogonType, SubStatus, SubStatus_hex])