topic Re: ASA MAC address re-format in All Apps and Add-ons

ASA MAC address re-format

andresito123 — Fri, 23 Sep 2016 09:31:13 GMT

Good morning community!

I have a dead-end and hope somebody helped me.

I have this Cisco ASA MAC address format: "0118.3a2d.584b.5e".

When I read Network Traffic data model, I saw the recommendation:

The destination TCP/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field. Note: Always use colons instead of dashes, spaces, or no separator.

The question is how I can transform at index time MAC address from "0118.3a2d.584b.5e" to "01:18:3a:2d:58:4b:5e".

Thanks in advance,
Andreas

Re: ASA MAC address re-format

inventsekar — Fri, 23 Sep 2016 09:46:57 GMT

pls check this one -
https://answers.splunk.com/answers/870/how-to-normalize-mac-address-format.html

Re: ASA MAC address re-format

andresito123 — Fri, 23 Sep 2016 14:36:52 GMT

I have tried this configuration on transforms.conf but with no luck:

[src_mac]
REGEX = 01([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})
FORMAT = src_mac::$1:$2:$3:$4:$5:$6

Re: ASA MAC address re-format

andresito123 — Mon, 26 Sep 2016 07:39:03 GMT

With a lot of research I found out the formula:

sourcetype="cisco:asa" message_id=604103 |rex mode=sed field=src_mac "s/01//g" | rex mode=sed field=src_mac "s/[:. -]//g" | rex mode=sed field=src_mac "s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/"

However, can I would like to have it at index time and not search time...

Re: ASA MAC address re-format

inventsekar — Mon, 26 Sep 2016 08:19:51 GMT

Hi, please check - Index-time field extraction examples
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Configureindex-timefieldextraction

Best Regards,
Sekar

Re: ASA MAC address re-format

mcronkrite_splu — Tue, 04 Oct 2016 21:45:42 GMT

You can use SEDCMD in props.conf on the indexer to perform this operation on the raw data before it gets indexed.