Good morning community!
I have a dead-end and hope somebody helped me.
I have this Cisco ASA MAC address format: "0118.3a2d.584b.5e".
When I read Network Traffic data model, I saw the recommendation:
The destination TCP/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field. Note: Always use colons instead of dashes, spaces, or no separator.
The question is how I can transform at index time MAC address from "0118.3a2d.584b.5e" to "01:18:3a:2d:58:4b:5e".
Thanks in advance,
Andreas
With a lot of research I found out the formula:
sourcetype="cisco:asa" message_id=604103 |rex mode=sed field=src_mac "s/01//g" | rex mode=sed field=src_mac "s/[:. -]//g" | rex mode=sed field=src_mac "s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/"
However, can I would like to have it at index time and not search time...
Hi, please check - Index-time field extraction examples
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Configureindex-timefieldextraction
Best Regards,
Sekar
With a lot of research I found out the formula:
sourcetype="cisco:asa" message_id=604103 |rex mode=sed field=src_mac "s/01//g" | rex mode=sed field=src_mac "s/[:. -]//g" | rex mode=sed field=src_mac "s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/"
However, can I would like to have it at index time and not search time...
You can use SEDCMD in props.conf on the indexer to perform this operation on the raw data before it gets indexed.
pls check this one -
https://answers.splunk.com/answers/870/how-to-normalize-mac-address-format.html
I have tried this configuration on transforms.conf but with no luck:
[src_mac]
REGEX = 01([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})
FORMAT = src_mac::$1:$2:$3:$4:$5:$6