How do I use the eval command to search by MAC format within a dashboard?

[paulzharyuk]

Hi Splunkers,

I'm not sure what I'm doing wrong maybe you guys can help me. I have a MAC field coming in from the Cisco Prime infrastructure in the correct format xx:xx:xx:xx. I built a dashboard to be able to search by MAC and get physical details about that specific MAC. I'm trying to be able to search using different MAC formats - "-", ":". I use the eval command within my search string without any luck.

index=dtna_network_ciscoprime ipAddress=$ipaddress$ 
| eval macAddress=replace(macAddress,"-",":") 
| where 
    macAddress="$macaddress$" 
| table ipAddress, macAddress, clientInterface, vendor, nt_host

My end goal is to be able to paste the MAC into the text box in any format ":", "-", "." and get the same results. Any help will be much appreciated.

[kamlesh_vaghela]

@paulzharyuk

Can you please try following search?

index=dtna_network_ciscoprime ipAddress=$ipaddress$ 
| eval macAddress=replace(macAddress,"-",":") , macAddress=replace(macAddress,"\.",":") 
| eval txtmacAddress="$macaddress$",txtmacAddress=replace(txtmacAddress,"-",":") , txtmacAddress=replace(txtmacAddress,"\.",":") 
| where macAddress=txtmacAddress
| table ipAddress, macAddress, clientInterface, vendor, nt_host

My Sample Search:

| makeresults 
| eval macAddress="10:0:1:1" 
| append 
    [| makeresults 
    | eval macAddress="10.0.1.1" ] 
| append 
    [| makeresults 
    | eval macAddress="10-0-1-1" ] 
| eval macAddress=replace(macAddress,"-",":") , macAddress=replace(macAddress,"\.",":") 
| eval txtmacAddress="10.0.1.1",txtmacAddress=replace(txtmacAddress,"-",":") , txtmacAddress=replace(txtmacAddress,"\.",":") 
| where macAddress=txtmacAddress

Note: In sample search $macaddress$= 10.0.1.1

Thanks