topic Re: Reformat a field in Splunk Search

Reformat a field

fk319 — Thu, 01 Mar 2012 20:57:31 GMT

My logs contain mac addresses. Sometimes they have colons and sometimes dots.
I want to build a view where the user inputs a mac and is able to search for both formats.

I looked at rewriting the mac with out colons in props.conf/transforms.conf, but could not figure out a method.

It looks like I am going to have to do it in the view, create a new field a mac with colons, and search for both.

Re: Reformat a field

lguinn2 — Thu, 01 Mar 2012 21:42:41 GMT

Try using something like the following, assuming that the user input in is $X$ and that the MAC address in the event has been extracted into a field named macAddr:

<your base search> | eval testMac = replace($X$,":",".") | where match(macAddr,testMac)

The eval command takes the user input, which is assumed to be in the form 00:B0:D0:86:BB:F7, and replaces the colons with dot (.)

The dot is the "match anything" character in regular expressions, so now the testMac field looks like 00.B0.D0.86.BB.F7 - as a regular expression, this will match anything as a separator.

The where command uses the match function to see if the macAddr field in the event matches the pattern. If yes, the event is returned, otherwise it is excluded from the search results.

Re: Reformat a field

fk319 — Thu, 01 Mar 2012 22:09:27 GMT

the problem is in the mac is both ways in the logs, so my search is:
mac="00:B0:D0:86:BB:F7" OR mac="00B0D086BBF7"

Re: Reformat a field

lguinn2 — Fri, 02 Mar 2012 23:09:41 GMT

| eval testMac = replace($X$,":",".{0,1}") |
where match(macAddr,testMac)

should work then

Re: Reformat a field

fk319 — Wed, 07 Mar 2012 13:15:12 GMT

What I ended up doing was creating two macros, one to strip out the colons and one that put them in. I was then able to include it in my search:

(macStrip($mac$) OR macColons($mac$)) |
I have to many macs in my logs to do a search and match. Thank you for your help.

Re: Reformat a field

lguinn2 — Wed, 07 Mar 2012 20:52:18 GMT

Nice solution with the macros