Splunk Search

How to create a regex that captures the first 6 characters of a mac address and removes the hyphen characters?

Explorer

I'm unable to create a regex that captures the first 6 characters of a mac address and removes the hyphen characters.

Here is the source data 00-2b-73-ab-1e-75
I need to change the source to 002B73

Here's my search | rex field =ClientId "(?) "

I'm getting stuck finding a regex statement that matches.

0 Karma
1 Solution

Ultra Champion

Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).* and then you can concatenate the three of them...

alt text

View solution in original post

0 Karma

Ultra Champion

Something like - (?<one>.*)-(?<two>.*)-(?<three>.*).* and then you can concatenate the three of them...

alt text

View solution in original post

0 Karma

Explorer

Thanks, I got it working by using (?<one>\w+)-(?<two>\w+)-(?<three>\w+)-(?<four>\w+)-(?<five>\w+)-(?<six>\w+)

Then I'll make upper case and concatenate one+two+three

0 Karma

Ultra Champion

Perfect @dkorlat.

0 Karma

Explorer

Thanks, I got it working by using [(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)-(?\w+)

I will make it in upper case and concatenate one+two+three in Splunk.

Thanks

0 Karma