Splunk Search

How to redefine a field definition to one minute character processed or modified

NC_AS
Explorer

Please tell me how to make the output replace some characters in the field definitions.

Specifically, the problem is that the following two formats of Mac Address in multiple logs imported into Splunk are mixed.
AA:BB:CC:00:11:22
AA-BB-CC-00-11-22
I would like to unify the MacAddress field in the log in the form of “AA:BB:CC:00:11:22” in advance, because I would like to link the host name from MacAddress in the automatic definition of LookUpTable.

Put the following in the search field and output the modified one as “MacAddr”,
index=“Log” | rex ^. +? \scli\s}? <CL_MacAddr>. +? (. +?)) \) | eval MacAddr = replace(CL_MacAddr,“-”,“:”)

Alternatively, we could replace the existing field “CL_MacAddr” with a modified version as follows.
index=“Log” | rex mode=sed field=“CL_MacAddr” “s/-/:/g”

I am trying to set this in the GUI's field extraction and field transformation to always have the modified superscript, but it does not work.
Or can it be set directly in transforms.conf, but in this case, what values can be set and where?

I know this is basic, but I would appreciate your help.
Thank you in advance.

Labels (1)
0 Karma
1 Solution

NC_AS
Explorer

@andrew_nelson 

I was able to set it up with a calculated field!
It was a basic thing, but it was very helpful.
I'm going to study!
thank you very much.

View solution in original post

0 Karma

andrew_nelson
Communicator

You're pretty much there with the first method using the eval. 
Its a calculated field you need, not a field extraction or field transformation. 
Settings > Fields > Calculated Fields > Create New. 

Then set your scope for index/sourcetype

Name: MacAddr

Eval Expression : replace(CL_MacAddr,“-”,“:”)

0 Karma

NC_AS
Explorer

@andrew_nelson 

I was able to set it up with a calculated field!
It was a basic thing, but it was very helpful.
I'm going to study!
thank you very much.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...