Hi there,
I wanna remove colons in a field value like a MAC Address.
I have a field MAC like mac="E8:11:32:31:33:BA", but I want to remove colons to get mac="E811323133BA"
How can I do it?
Thanks,
I'd use rex in mode=sed (see newmac3 code below). richgalloway's method (newmac1 code below) also works.
| makeresults
| eval mac="E8:11:32:31:33:BA"
| eval newmac1=mac, newmac2=mac, newmac3=mac
| eval newmac1=replace (newmac1,":","")
| replace "*:*" with "**" in newmac2
| rex field=newmac3 mode=sed "s/://g"
| table mac, newmac1, newmac2, newmac3
...results in...
mac newmac1 newmac2 newmac3
E8:11:32:31:33:BA E811323133BA E811:32:31:33:BA E811323133BA
I'd use rex in mode=sed (see newmac3 code below). richgalloway's method (newmac1 code below) also works.
| makeresults
| eval mac="E8:11:32:31:33:BA"
| eval newmac1=mac, newmac2=mac, newmac3=mac
| eval newmac1=replace (newmac1,":","")
| replace "*:*" with "**" in newmac2
| rex field=newmac3 mode=sed "s/://g"
| table mac, newmac1, newmac2, newmac3
...results in...
mac newmac1 newmac2 newmac3
E8:11:32:31:33:BA E811323133BA E811:32:31:33:BA E811323133BA
I downvoted this post because doesnt eloquently answer the question. not that it doesnt answer the question... just the only thing they needed was:
| eval newmac1=replace (mac,":","")
@jtrujillo - Please reread my answer. Only line 6 in mine is needed, which is why my answer starts off with "I'd use rex in mode=sed (see newmac3 code below)."
I may occasionally use a few more words than other people, but when I do it's usually intended to teach. The rest is there to demonstrate that the rex mode=sed
and the replace
method (that you liked) both work, using run-anywhere code that anyone can run to verify for themselves, and also posting the output from the entire search.
Line 4 demonstrates that @richgalloway's method works correctly.
Line 5 demonstrates that @MOberschelp's method only removes the first colon.
Line 6 demonstrates that my way works correctly.
Please also read the comment on my answer by the original poster.
Wow, Thank you very much DalJeanis.
You have been a great help to me.
Thanks again.
Try eval mac=replace (mac,":","")
.
Thank you richgalloway. it works that I want.
Please make sure and upvote the helpful ones that work!
I think the replace command should help.. try:
| replace "*:*" with "**" in [FIELDNAME]
Thank you for your comment.
It work for the first colon. : )
This method would only work for the first colon. See the test results in my answer.