topic Re: Why is my query with the eval command not replacing dashes (MAC Address Formats)? in Splunk Search

Why is my query with the eval command not replacing dashes (MAC Address Formats)?

richardphung — Mon, 17 Dec 2018 18:19:40 GMT

so, I'm working on implementing this:

https://answers.splunk.com/answers/588964/how-can-we-make-multiple-mac-address-formats-be-re.html

In conjunction with:

https://answers.splunk.com/answers/472849/how-to-set-a-field-as-the-token-to-use-in-a-dashbo.html

And I am very close.

This is dependent on an eval that replaces either colon(:) or dashes(-) and returns the MacAddress as a string of octets.

The eval function:

$macaddress$
      | eval MAC=replace("$macaddress$","[\s.:-]","")
      | rex field=MAC "^(?<octet1>..)(?<octet2>..)(?<octet3>..)(?<octet4>..)(?<octet5>..)(?<octet6>..)$"

Now, the problem here is that it works great if the macaddress is colon delimited..
e.g. 00:00:00:00:00:00

But, it fails to eval if there are dashes--- e.g. 00-00-00-00-00-00 or if there are no delimiters

Full Search (with set token):

        <search>
          <done>
            <set token="octet1">$result.octet1$</set>
            <set token="octet2">$result.octet2$</set>
            <set token="octet3">$result.octet3$</set>
            <set token="octet4">$result.octet4$</set>
            <set token="octet5">$result.octet5$</set>
            <set token="octet6">$result.octet6$</set>
          </done>
          <query>$macaddress$
| eval MAC=replace("$macaddress$","[\s.:-]","")
          | rex field=MAC "^(?&lt;octet1&gt;..)(?&lt;octet2&gt;..)(?&lt;octet3&gt;..)(?&lt;octet4&gt;..)(?&lt;octet5&gt;..)(?&lt;octet6&gt;..)$"
          | dedup octet1
| table octet1 octet2 octet3 octet4 octet5 octet6</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>

Re: Why is my query with the eval command not replacing dashes (MAC Address Formats)?

twinspop — Mon, 17 Dec 2018 19:00:17 GMT

In regex a dash in a character class (square brackets) has to be the first thing listed:

... | eval MAC=replace("$macaddress$","[-\s.:]","")

Re: Why is my query with the eval command not replacing dashes (MAC Address Formats)?

richardphung — Mon, 17 Dec 2018 19:55:34 GMT

Still no go.

In fact, it doesn't evaluate even if I use dash, explicit:

| eval MAC=replace("$macaddress$","-","")

Re: Why is my query with the eval command not replacing dashes (MAC Address Formats)?

twinspop — Mon, 17 Dec 2018 20:13:17 GMT

Possibly its not a normal dash? Why not replace everything that's not alphanumeric? replace("$macaddress$","[^A-Za-z0-9]*","")

Re: Why is my query with the eval command not replacing dashes (MAC Address Formats)?

richardphung — Mon, 17 Dec 2018 20:32:59 GMT

That make sense...
but it's not liking that either.
Using:

replace("$macaddress$","[^A-Za-z0-9]*","")

Any special character other than a colon doesn't work.
e.g. 00@00@00@00@00@00

Re: Why is my query with the eval command not replacing dashes (MAC Address Formats)?

woodcock — Mon, 11 Feb 2019 08:25:22 GMT

Just use a better RegEx this skips over whatever is there (if anything). Try this:

$macaddress$
| rex field=$macaddress$ "^(?<octet1>\w{2})\W*(?<octet2>\w{2})\W*(?<octet3>\w{2})\W*(?<octet4>\w{2})\W*(?<octet5>\w{2})\W*(?<octet6>\w{2})$"
| dedup octet1
| table octet1 octet2 octet3 octet4 octet5 octet6

P.S. Your problem was almost certainly the double-quotes in replace("$macaddress$".