Reformat a field

[fk319]

My logs contain mac addresses. Sometimes they have colons and sometimes dots.
I want to build a view where the user inputs a mac and is able to search for both formats.

I looked at rewriting the mac with out colons in props.conf/transforms.conf, but could not figure out a method.

It looks like I am going to have to do it in the view, create a new field a mac with colons, and search for both.

[lguinn2 · Accepted solution]

Try using something like the following, assuming that the user input in is $X$ and that the MAC address in the event has been extracted into a field named macAddr:

<your base search> | eval testMac = replace($X$,":",".") | where match(macAddr,testMac)

The eval command takes the user input, which is assumed to be in the form 00:B0:D0:86:BB:F7, and replaces the colons with dot (.)

The dot is the "match anything" character in regular expressions, so now the testMac field looks like 00.B0.D0.86.BB.F7 - as a regular expression, this will match anything as a separator.

The where command uses the match function to see if the macAddr field in the event matches the pattern. If yes, the event is returned, otherwise it is excluded from the search results.

[lguinn2]

Nice solution with the macros

[fk319]

What I ended up doing was creating two macros, one to strip out the colons and one that put them in. I was then able to include it in my search:

(macStrip($mac$) OR macColons($mac$)) |
I have to many macs in my logs to do a search and match. Thank you for your help.

[lguinn2]

| eval testMac = replace($X$,":",".{0,1}") |
where match(macAddr,testMac)

should work then

[fk319]

the problem is in the mac is both ways in the logs, so my search is:
mac="00:B0:D0:86:BB:F7" OR mac="00B0D086BBF7"