Thanks for your response Kristian. I used your regex to build a little table to parse out the Cisco mac notification snmp-trap.
The 12 byte hex string has the following information in it.
first byte = operation (01 for added and 02 for removed mac address from its arp tables)
second+third byte = VLan (In HEX)
fourth-ninth byte = MAC Address
tenth-eleventh byte = Switch Interface (In HEX)
twelfth byte = operation (never seen this byte used)
Here is what I did with your help.
my_search | rex "Hex-STRING:(? [\sa-fA-F0-9]{3})(? [\sa-fA-F0-9]{6})(? [\sa-fA-F0-9]{18})(? [\sa-fA-F0-9]{6})" | rex "(?i)(?P [^ ]+)\s+(?:\[[^\n\[]*){2}" | eval ACTION2=replace(ACTION1,"01","Added") | eval ACTION=replace(ACTION2,"02","Removed") | eval VLAN1=replace(VLAN_HEX,"\s","") | eval PORT1=replace(PORT_HEX,"\s","") | eval PORT=tonumber(PORT1, 16) | eval VLAN=tonumber(VLAN1, 16) | table _time, MAC_ADDRESS, ACTION, VLAN, PORT, SWITCH
... View more
