I'm unable to create a regex that captures the first 6 characters of a mac address and removes the hyphen characters.
Here is the source data 00-2b-73-ab-1e-75
I need to change the source to 002B73
Here's my search | rex field =ClientId "(?) "
I'm getting stuck finding a regex statement that matches.
Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).*
and then you can concatenate the three of them...
Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).*
and then you can concatenate the three of them...
Thanks, I got it working by using (?<one>\w+)-(?<two>\w+)-(?<three>\w+)-(?<four>\w+)-(?<five>\w+)-(?<six>\w+)
Then I'll make upper case and concatenate one+two+three
Perfect @dkorlat.
Thanks, I got it working by using [(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)
I will make it in upper case and concatenate one+two+three in Splunk.
Thanks