Splunk Search

Regex Help!

kiran331
Builder

How can I change the format of the filed values using regex.

what it is now:
0xBCDDADAF7BSS

What I need:
remove 0x and : in between after 2 characters

BC:DD:AD:AF:7B:SS

Tags (2)
0 Karma
1 Solution

msivill_splunk
Splunk Employee
Splunk Employee

A longer alternative..........

| stats count as text | eval text = "0xBCDDADAF7BSS" | rex field=text "0x(?<text_trim>.*)" | eval text_trim_colon = text_trim | rex field=text_trim_colon mode=sed "s/(..)/&:/g" | rex field=text_trim_colon "(?<text_trim_colon_result>.*):"

With the added bonus of handling fields of different lengths (multiples of 2)

View solution in original post

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

A longer alternative..........

| stats count as text | eval text = "0xBCDDADAF7BSS" | rex field=text "0x(?<text_trim>.*)" | eval text_trim_colon = text_trim | rex field=text_trim_colon mode=sed "s/(..)/&:/g" | rex field=text_trim_colon "(?<text_trim_colon_result>.*):"

With the added bonus of handling fields of different lengths (multiples of 2)

0 Karma

javiergn
Super Champion

Just two comments:

1) If your number is hexadecimal then the SS at the end is wrong. If that was the case simply do the following:

your base search
| rex field=myfield max_match=0 "(?<newfield>[0-9a-fA-F]{2})"
| eval newfield = mvjoin(newfield, ":")

2) If your word can contain any characters (I don't understand the 0x then) you can try this instead:

your base search
| eval myfield = substr(myfield, 3)
| rex field=myfield max_match=0 "(?<newfield>[0-9a-zA-Z]{2})"
| eval newfield = mvjoin(newfield, ":")

Hope that helps

0 Karma

gcusello
SplunkTrust
SplunkTrust

add to your search

| rex "\w\w(?<ppp1>.{2})(?<ppp2>.{2})(?<ppp3>.{2})(?<ppp4>.{2})(?<ppp5>.{2})(?<ppp6>.{2})" | eval mynewfield=ppp1+":"+ppp2+":"+ppp3+":"+ppp4+":"+ppp5+":"+ppp6

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...