extracting special characters using reg

[royimad]

I have a log file as the following

Event1: datetime1 any data xyz [macaddress]{2020-23233-23232-21123} any data { abc }
Event2: datetime2 any data abc [macaddress]{02:00:00:00:00} any data { [ hello ] }

In the middle of each event i have a macaddress name between [ ] and the macaddress value between {}
what is the regular expression that let me extract the macaddress value?

i'm trying this but it's not working search | rex "[macaddress]{(?)}"

[MuS · Accepted solution]

Hi royimad,

try something like this:

your base search here | rex "\[(?<myadd>\w+)\]\{(?<myMAC>([\w\d]+[:-])+[\w\d]+)\}" | tabel myadd myMAC

and to match only the IEEE 802 standard you should use this regex

your base search here | rex "\[(?<myadd>\w+)\]\{(?<myMAC>([\w\d]+[:-]){5}[\w\d]+)\}" | tabel myadd myMAC

hope this helps ...

cheers, MuS

[MuS]

Maybe you should have a look at my App http://apps.splunk.com/app/1249 😉
to your question, this could be done using a lookup

[royimad]

If i know exactly that myadd is equal to macaddress in all the case but not a random word how can i simplified this ?

[royimad]

Perfect thank you.

[MuS]

Hi dude,

well this is based on your provided information 😉 try this

\[(?<myadd>\w+)\]\{(?<myMAC>([\w\d]+[:-])+[\w\d]+)\}

which works perfect in all of those different online regex testers

[royimad]

Hello dude,

There are 2 different type of mac address either separated by : or either separated by - and not necessary contains digital letter a mac address could contain any characters other then special ( Your query is working for the mac address separated by : )