topic Re: How can I remove colons in a field value in Splunk Search

How can I remove colons in a field value

superhm — Mon, 06 Mar 2017 09:08:07 GMT

Hi there,

I wanna remove colons in a field value like a MAC Address.

I have a field MAC like mac="E8:11:32:31:33:BA", but I want to remove colons to get mac="E811323133BA"

How can I do it?

Thanks,

Re: How can I remove colons in a field value

MOberschelp — Mon, 06 Mar 2017 13:44:52 GMT

I think the replace command should help.. try:

| replace "*:*" with "**" in [FIELDNAME]

Re: How can I remove colons in a field value

richgalloway — Mon, 06 Mar 2017 13:55:38 GMT

Try eval mac=replace (mac,":","").

Re: How can I remove colons in a field value

DalJeanis — Mon, 06 Mar 2017 15:23:58 GMT

This method would only work for the first colon. See the test results in my answer.

Re: How can I remove colons in a field value

DalJeanis — Mon, 06 Mar 2017 15:30:36 GMT

I'd use rex in mode=sed (see newmac3 code below). richgalloway's method (newmac1 code below) also works.

| makeresults 
| eval mac="E8:11:32:31:33:BA" 
| eval newmac1=mac, newmac2=mac, newmac3=mac
| eval newmac1=replace (newmac1,":","")
| replace "*:*" with "**" in newmac2
| rex field=newmac3 mode=sed "s/://g" 
| table mac, newmac1, newmac2, newmac3

...results in...

mac                newmac1       newmac2           newmac3           
E8:11:32:31:33:BA  E811323133BA  E811:32:31:33:BA  E811323133BA

Re: How can I remove colons in a field value

superhm — Mon, 06 Mar 2017 23:16:09 GMT

Thank you richgalloway. it works that I want.

Re: How can I remove colons in a field value

superhm — Mon, 06 Mar 2017 23:23:22 GMT

Wow, Thank you very much DalJeanis.
You have been a great help to me.
Thanks again.

Re: How can I remove colons in a field value

superhm — Mon, 06 Mar 2017 23:28:12 GMT

Thank you for your comment.
It work for the first colon. : )

Re: How can I remove colons in a field value

DalJeanis — Tue, 07 Mar 2017 00:50:58 GMT

Please make sure and upvote the helpful ones that work!

Re: How can I remove colons in a field value

jtrujillo — Tue, 03 Oct 2017 21:26:30 GMT

I downvoted this post because doesnt eloquently answer the question. not that it doesnt answer the question... just the only thing they needed was:

| eval newmac1=replace (mac,":","")

Re: How can I remove colons in a field value

DalJeanis — Wed, 04 Oct 2017 12:16:51 GMT

@jtrujillo - Please reread my answer. Only line 6 in mine is needed, which is why my answer starts off with "I'd use rex in mode=sed (see newmac3 code below)."

I may occasionally use a few more words than other people, but when I do it's usually intended to teach. The rest is there to demonstrate that the rex mode=sed and the replace method (that you liked) both work, using run-anywhere code that anyone can run to verify for themselves, and also posting the output from the entire search.

Line 4 demonstrates that @richgalloway's method works correctly.
Line 5 demonstrates that @MOberschelp's method only removes the first colon.
Line 6 demonstrates that my way works correctly.

Please also read the comment on my answer by the original poster.