All Apps and Add-ons

Mac address field extraction


So I have a situation where all my logs come in via syslog (sourcetype=syslog, source=udp:514) and are lumped together. The first this I would like to do is to extract a mac address for reporting that can occur anywhere in a dhcpd message. I'm unable to figure out how to flag this easily. Any one have any thoughts? Here are a few examples:

dhcpd: DHCPACK on to 00:00:00:00:00:00 via
dhcpd: DHCPREQUEST for from via
dhcpd: DHCPDISCOVER from 00:00:00:00:00:00 via network no free leases

The other issue at play here is we may want to do this at index time. Is there any easy way to do this since everything is sourcetype=syslog and lumped in with a large number of other types of unrelated log messages (routers, switches, etc).

0 Karma

Splunk Employee
Splunk Employee

try something like this tat will handle multiple formats.
and format without any separators.

| rex "(?<mac>[a-fA-F0-9\.:-]{12,17})"
| rex field=mac mode=sed "s/(\.|:|-)//g"

0 Karma


Can you explain why you want to do it at index-time?

0 Karma


the apps for has got it all : DHCPD App, did you have a look at it?


This app has gone mysteriously missing recently 😞

0 Karma