As I said in the beginning, I'm just a beginner with Splunk. I search a DHCP database for the MAC address that had an IP address lease on a certain date. The DHCP database returns the MAC in the format a4:fc:77:3b:08:b7, I'm looking for a search string to search the Splunk logs on a specific date, currently I'm running the search below but I have to manually change the colons into dashes: index=foo "a4-fc-77-3b-08-b7" Everything I've tried so far has either failed or not returned the required information. ... View more

If i put the below strings into the search bar it returns the MAC address in the correct format, but it only searches today's logs despite what date range I've selected | makeresults | eval mac="a4:fc:77:3b:08:b7" | rex field=mac mode=sed "s/:/-/g" _time mac 2020-02-07 16:06:42 a4-fc-77-3b-08-b7 ... View more

This part of the search returns all of the events where the user full name and emergency contact full name match, and the service area is a service area I am concerned with. index="A" | rex mode=sed field=User_Full_Name "s/ //g" | eval User_Full_Name = LOWER(User_Full_Name) | rex mode=sed field=Emergency_Contact1 "s/ //g" | eval Emergency_Contact1 = LOWER(Emergency_Contact1) | eval results = if(match(Emergency_Contact1,User_Full_Name), "match", "no match") | dedup User_Full_Name | search results="match" | eval Service_Areas=split(Patient_Service_Areas, ",") | search Service_Areas="50*" The problem is about 80% of the returned results are false positives for my purposes so I need to execute an additional search that takes the user logon ID (user's Windows AD username) from a returned event and looks it up in our identity management system (contained in a different index) to see if the user is one of our users or not, and only return the events where the user in the event exists in our identity management system. That's where I try to work this search in. | eval User_Logon_ID = LOWER(User_Logon_ID) | search index="B" | eval HSCNET_ID = LOWER(HSCNET_ID) | eval results = if(match(User_Logon_ID,HSCNET_ID), "USF", "no USF") | search results="USF" ... View more