All Apps and Add-ons
Highlighted

ASA MAC address re-format

Communicator

Good morning community!

I have a dead-end and hope somebody helped me.

I have this Cisco ASA MAC address format: "0118.3a2d.584b.5e".

When I read Network Traffic data model, I saw the recommendation:

The destination TCP/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field. Note: Always use colons instead of dashes, spaces, or no separator.

The question is how I can transform at index time MAC address from "0118.3a2d.584b.5e" to "01:18:3a:2d:58:4b:5e".

Thanks in advance,
Andreas

0 Karma
Highlighted

Re: ASA MAC address re-format

Champion
0 Karma
Highlighted

Re: ASA MAC address re-format

Communicator

I have tried this configuration on transforms.conf but with no luck:

[src_mac]
REGEX = 01([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})([0-9A-Fa-f]{2})[.]([0-9A-Fa-f]{2})
FORMAT = src_mac::$1:$2:$3:$4:$5:$6
0 Karma
Highlighted

Re: ASA MAC address re-format

Communicator

With a lot of research I found out the formula:

sourcetype="cisco:asa" message_id=604103 |rex mode=sed field=src_mac "s/01//g" | rex mode=sed field=src_mac "s/[:. -]//g" | rex mode=sed field=src_mac "s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/"

However, can I would like to have it at index time and not search time...

View solution in original post

0 Karma
Highlighted

Re: ASA MAC address re-format

Splunk Employee
Splunk Employee

You can use SEDCMD in props.conf on the indexer to perform this operation on the raw data before it gets indexed.

0 Karma
Highlighted

Re: ASA MAC address re-format

Champion

Hi, please check - Index-time field extraction examples
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Configureindex-timefieldextraction

Best Regards,
Sekar