Splunk Search

How to separate SNMP GETBULK ARP table MIB Data into something readable?

pzharyuk
New Member

Hi Guys I'm fairly new to Splunk and SPL can someone help me break the below data into readable fields?

RFC1213-MIB::ipNetToMediaPhysAddress."14"."53.x.x.x" = "0x000000000000" RFC1213-MIB::ipNetToMediaPhysAddress."14"."53.x.x.x" = "0x000000000000" RFC1213-MIB::ipNetToMediaPhysAddress."51"."53.x.x.x" = "0x000000000000" RFC1213-MIB::ipNetToMediaPhysAddress."51"."53.x.x.x" = "0x000000000000

I'm able to extract the arp tables from my core routers and I want to create two tables, one will be IP and the other will be MAC

I want the IP table to include the 53*'s and the MAC filed to have the MAC's that start with 0x... I would like to omit 0x if possible.

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

Can you please try below regex , this will generate IP and MAC fields.

<yourBaseSearch> | rex "ipNetToMediaPhysAddress\.\"\d+\"\.\"(?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\"\s+\=\s+\"0x(?<MAC>\w+)" max_match=0

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

Can you please try below regex , this will generate IP and MAC fields.

<yourBaseSearch> | rex "ipNetToMediaPhysAddress\.\"\d+\"\.\"(?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\"\s+\=\s+\"0x(?<MAC>\w+)" max_match=0
0 Karma

pzharyuk
New Member

Thank you, works exactly as I wanted it!

0 Karma

pzharyuk
New Member

One more question. The MAC address filed comes through nicely, however the mac address comes in this format "34dbfd8de246 " is there a way to add semi colons to make it have semi colons like this "34:db:fd:8d:e2:46" within the same regex string without having to use the eval?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...