Dashboards & Visualizations

How do I use the eval command to search by MAC format within a dashboard?

paulzharyuk
New Member

Hi Splunkers,

I'm not sure what I'm doing wrong maybe you guys can help me. I have a MAC field coming in from the Cisco Prime infrastructure in the correct format xx:xx:xx:xx. I built a dashboard to be able to search by MAC and get physical details about that specific MAC. I'm trying to be able to search using different MAC formats - "-", ":". I use the eval command within my search string without any luck.

index=dtna_network_ciscoprime ipAddress=$ipaddress$ 
| eval macAddress=replace(macAddress,"-",":") 
| where 
    macAddress="$macaddress$" 
| table ipAddress, macAddress, clientInterface, vendor, nt_host

My end goal is to be able to paste the MAC into the text box in any format ":", "-", "." and get the same results. Any help will be much appreciated.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@paulzharyuk

Can you please try following search?

index=dtna_network_ciscoprime ipAddress=$ipaddress$ 
| eval macAddress=replace(macAddress,"-",":") , macAddress=replace(macAddress,"\.",":") 
| eval txtmacAddress="$macaddress$",txtmacAddress=replace(txtmacAddress,"-",":") , txtmacAddress=replace(txtmacAddress,"\.",":") 
| where macAddress=txtmacAddress
| table ipAddress, macAddress, clientInterface, vendor, nt_host

My Sample Search:

| makeresults 
| eval macAddress="10:0:1:1" 
| append 
    [| makeresults 
    | eval macAddress="10.0.1.1" ] 
| append 
    [| makeresults 
    | eval macAddress="10-0-1-1" ] 
| eval macAddress=replace(macAddress,"-",":") , macAddress=replace(macAddress,"\.",":") 
| eval txtmacAddress="10.0.1.1",txtmacAddress=replace(txtmacAddress,"-",":") , txtmacAddress=replace(txtmacAddress,"\.",":") 
| where macAddress=txtmacAddress

Note: In sample search $macaddress$= 10.0.1.1

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...