https://community.splunk.com/t5/Getting-Data-In/Normalizing-MAc-for-Assets-and-identity/m-p/657561#M111297 <LI-CODE lang="markup">| rex mode=sed field=mac "s/(..):(..):(..):(..):(..):(..)/\1-\2-\3-\4-\5-\6/g"</LI-CODE> Thu, 14 Sep 2023 08:55:54 GMT ITWhisperer 2023-09-14T08:55:54Z https://community.splunk.com/t5/Getting-Data-In/Normalizing-MAc-for-Assets-and-identity/m-p/657546#M111294 <P>Hi,<BR />How can we normalize MAC addresses (such as XX:XX:XX:XX:XX:XX or XX-XX-XX-XX-XX-XX) in our environment before implementing the asset and identity in splunk ES, as we are collecting data from<SPAN>&nbsp;workspace.</SPAN></P> Thu, 14 Sep 2023 07:15:53 GMT https://community.splunk.com/t5/Getting-Data-In/Normalizing-MAc-for-Assets-and-identity/m-p/657546#M111294 smith_ 2023-09-14T07:15:53Z https://community.splunk.com/t5/Getting-Data-In/Normalizing-MAc-for-Assets-and-identity/m-p/657561#M111297 <LI-CODE lang="markup">| rex mode=sed field=mac "s/(..):(..):(..):(..):(..):(..)/\1-\2-\3-\4-\5-\6/g"</LI-CODE> Thu, 14 Sep 2023 08:55:54 GMT https://community.splunk.com/t5/Getting-Data-In/Normalizing-MAc-for-Assets-and-identity/m-p/657561#M111297 ITWhisperer 2023-09-14T08:55:54Z