Good morning Splunkers! I need help sorting through a list of MAC Addresses. I have a dashboard that lists them in a drilldown table. I have some list of 900 MAC Addresses and using the command below helps me pass the search results to another instance of Splunk to insert them into a search. However, I am getting 414 errors for the URI being too long if there are more than 120 MAC Addresses used. | eval MAC_UNIT=replace(MacAddress, "(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})", "\1:\2:\3:\4:\5:\6") | fields MAC_UNIT | format My question: is there a way to select a range of values/results? I'd like to use radio buttons to select results 0-100, 101-200, 201-300, etc. ... View more

Good morning Splunkers! I need help please! I am working on a dashboard that shows a list of MAC Addresses and sometimes the list is over 100 different addresses depending on the area. So basically, I need to take multiple rows and put them into one line. I have a table that utilizes the nomv command, but it limits the MAC Addresses to 100. I use this table to drilldown to a custom URL, which is another Splunk instance that passes the list of MAC Addresses into another search for further processing. Below is what I have to place colons between every two characters of an unformatted MAC Address then throws it into a stats command to list and add " OR " between each one and finally, the nomv takes multivalue fields and puts it into one row. I've played around with using the head and tail command to get as much as I can, however, it is not enough and gives some duplicates if less than 200. | eval MAC_Address=replace(MacAddress, "(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})", "\1:\2:\3:\4:\5:\6") | stats list(MAC_Address) as MAC_Address delim=" OR " | nomv MAC_Address I was wondering if there is another command/way that will allow me to take more than 100 and put them into one line to pass through? I am open to other methods such as scripting to accomplish this. ... View more