topic Re: Regex Help! in Splunk Search

Regex Help!

kiran331 — Fri, 30 Sep 2016 15:18:36 GMT

How can I change the format of the filed values using regex.

what it is now:
0xBCDDADAF7BSS

What I need:
remove 0x and : in between after 2 characters

BC:DD:AD:AF:7B:SS

Re: Regex Help!

gcusello — Fri, 30 Sep 2016 15:40:38 GMT

add to your search

| rex "\w\w(?<ppp1>.{2})(?<ppp2>.{2})(?<ppp3>.{2})(?<ppp4>.{2})(?<ppp5>.{2})(?<ppp6>.{2})" | eval mynewfield=ppp1+":"+ppp2+":"+ppp3+":"+ppp4+":"+ppp5+":"+ppp6

Bye.
Giuseppe

Re: Regex Help!

javiergn — Fri, 30 Sep 2016 15:46:24 GMT

Just two comments:

1) If your number is hexadecimal then the SS at the end is wrong. If that was the case simply do the following:

your base search
| rex field=myfield max_match=0 "(?<newfield>[0-9a-fA-F]{2})"
| eval newfield = mvjoin(newfield, ":")

2) If your word can contain any characters (I don't understand the 0x then) you can try this instead:

your base search
| eval myfield = substr(myfield, 3)
| rex field=myfield max_match=0 "(?<newfield>[0-9a-zA-Z]{2})"
| eval newfield = mvjoin(newfield, ":")

Hope that helps

Re: Regex Help!

msivill_splunk — Fri, 30 Sep 2016 15:48:22 GMT

A longer alternative..........

| stats count as text | eval text = "0xBCDDADAF7BSS" | rex field=text "0x(?<text_trim>.*)" | eval text_trim_colon = text_trim | rex field=text_trim_colon mode=sed "s/(..)/&:/g" | rex field=text_trim_colon "(?<text_trim_colon_result>.*):"

With the added bonus of handling fields of different lengths (multiples of 2)