Why is my query with the eval command not replacing dashes (MAC Address Formats)?

[richardphung]

so, I'm working on implementing this:

https://answers.splunk.com/answers/588964/how-can-we-make-multiple-mac-address-formats-be-re.html

In conjunction with:

https://answers.splunk.com/answers/472849/how-to-set-a-field-as-the-token-to-use-in-a-dashbo.html

And I am very close.

This is dependent on an eval that replaces either colon(:) or dashes(-) and returns the MacAddress as a string of octets.

The eval function:

$macaddress$
      | eval MAC=replace("$macaddress$","[\s.:-]","")
      | rex field=MAC "^(?<octet1>..)(?<octet2>..)(?<octet3>..)(?<octet4>..)(?<octet5>..)(?<octet6>..)$"

Now, the problem here is that it works great if the macaddress is colon delimited..
e.g. 00:00:00:00:00:00

But, it fails to eval if there are dashes--- e.g. 00-00-00-00-00-00 or if there are no delimiters

Full Search (with set token):

        <search>
          <done>
            <set token="octet1">$result.octet1$</set>
            <set token="octet2">$result.octet2$</set>
            <set token="octet3">$result.octet3$</set>
            <set token="octet4">$result.octet4$</set>
            <set token="octet5">$result.octet5$</set>
            <set token="octet6">$result.octet6$</set>
          </done>
          <query>$macaddress$
| eval MAC=replace("$macaddress$","[\s.:-]","")
          | rex field=MAC "^(?&lt;octet1&gt;..)(?&lt;octet2&gt;..)(?&lt;octet3&gt;..)(?&lt;octet4&gt;..)(?&lt;octet5&gt;..)(?&lt;octet6&gt;..)$"
          | dedup octet1
| table octet1 octet2 octet3 octet4 octet5 octet6</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>

[woodcock]

Just use a better RegEx this skips over whatever is there (if anything). Try this:

$macaddress$
| rex field=$macaddress$ "^(?<octet1>\w{2})\W*(?<octet2>\w{2})\W*(?<octet3>\w{2})\W*(?<octet4>\w{2})\W*(?<octet5>\w{2})\W*(?<octet6>\w{2})$"
| dedup octet1
| table octet1 octet2 octet3 octet4 octet5 octet6

P.S. Your problem was almost certainly the double-quotes in replace("$macaddress$".

[twinspop]

In regex a dash in a character class (square brackets) has to be the first thing listed:

... | eval MAC=replace("$macaddress$","[-\s.:]","")

[richardphung]

Still no go.

In fact, it doesn't evaluate even if I use dash, explicit:

| eval MAC=replace("$macaddress$","-","")

[twinspop]

Possibly its not a normal dash? Why not replace everything that's not alphanumeric? replace("$macaddress$","[^A-Za-z0-9]*","")

[richardphung]

That make sense...
but it's not liking that either.
Using:

replace("$macaddress$","[^A-Za-z0-9]*","")

Any special character other than a colon doesn't work.
e.g. 00@00@00@00@00@00