Splunk Search

How to create a regex that captures the first 6 characters of a mac address and removes the hyphen characters?

dkorlat
Explorer

I'm unable to create a regex that captures the first 6 characters of a mac address and removes the hyphen characters.

Here is the source data 00-2b-73-ab-1e-75
I need to change the source to 002B73

Here's my search | rex field =ClientId "(?) "

I'm getting stuck finding a regex statement that matches.

0 Karma
1 Solution

ddrillic
Ultra Champion

Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).* and then you can concatenate the three of them...

alt text

View solution in original post

0 Karma

ddrillic
Ultra Champion

Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).* and then you can concatenate the three of them...

alt text

0 Karma

dkorlat
Explorer

Thanks, I got it working by using (?<one>\w+)-(?<two>\w+)-(?<three>\w+)-(?<four>\w+)-(?<five>\w+)-(?<six>\w+)

Then I'll make upper case and concatenate one+two+three

0 Karma

ddrillic
Ultra Champion

Perfect @dkorlat.

0 Karma

dkorlat
Explorer

Thanks, I got it working by using [(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)

I will make it in upper case and concatenate one+two+three in Splunk.

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...