ASA MAC address re-format

[andresito123]

Good morning community!

I have a dead-end and hope somebody helped me.

I have this Cisco ASA MAC address format: "0118.3a2d.584b.5e".

When I read Network Traffic data model, I saw the recommendation:

The destination TCP/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field. Note: Always use colons instead of dashes, spaces, or no separator.

The question is how I can transform at index time MAC address from "0118.3a2d.584b.5e" to "01:18:3a:2d:58:4b:5e".

Thanks in advance,
Andreas

[inventsekar]

Hi, please check - Index-time field extraction examples
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Configureindex-timefieldextraction

Best Regards,
Sekar

[andresito123 · Accepted solution]

With a lot of research I found out the formula:

sourcetype="cisco:asa" message_id=604103 |rex mode=sed field=src_mac "s/01//g" | rex mode=sed field=src_mac "s/[:. -]//g" | rex mode=sed field=src_mac "s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/"

However, can I would like to have it at index time and not search time...

[mcronkrite_splu]

You can use SEDCMD in props.conf on the indexer to perform this operation on the raw data before it gets indexed.

[inventsekar]

pls check this one -
https://answers.splunk.com/answers/870/how-to-normalize-mac-address-format.html

[andresito123]

I have tried this configuration on transforms.conf but with no luck:

[src_mac]
REGEX = 01([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})
FORMAT = src_mac::$1:$2:$3:$4:$5:$6