Splunk Search

How to create a regex that captures the first 6 characters of a mac address and removes the hyphen characters?

dkorlat
Explorer

I'm unable to create a regex that captures the first 6 characters of a mac address and removes the hyphen characters.

Here is the source data 00-2b-73-ab-1e-75
I need to change the source to 002B73

Here's my search | rex field =ClientId "(?) "

I'm getting stuck finding a regex statement that matches.

0 Karma
1 Solution

ddrillic
Ultra Champion

Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).* and then you can concatenate the three of them...

alt text

View solution in original post

0 Karma

ddrillic
Ultra Champion

Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).* and then you can concatenate the three of them...

alt text

View solution in original post

0 Karma

dkorlat
Explorer

Thanks, I got it working by using (?<one>\w+)-(?<two>\w+)-(?<three>\w+)-(?<four>\w+)-(?<five>\w+)-(?<six>\w+)

Then I'll make upper case and concatenate one+two+three

0 Karma

ddrillic
Ultra Champion

Perfect @dkorlat.

0 Karma

dkorlat
Explorer

Thanks, I got it working by using [(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)

I will make it in upper case and concatenate one+two+three in Splunk.

Thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.