Autoformat and search results similar to "48a4.93b9.xxxx OR 48:a4:93:b9:xx:xx OR 48-a4-93-b9-xx-xx"

[anthonyi]

Hello.

This search returns zero results, but a manual "OR" search shows results. I cannot find the reason (neither can ChatGPT). The end result would be a query where I can input any format of MAC address in one section, but automatically search for all formats shown. 

Any guidance would be appreciated. BTW, this is a local Splunk installation. 

(Please ignore the "xxxx".)

| makeresults
| eval input_mac="48a4.93b9.xxxx"
| eval mac_clean=lower(replace(input_mac, "[^0-9A-Fa-f]", ""))
| eval mac_colon=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1:\2:\3:\4:\5:\6")
| eval mac_hyphen=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1-\2-\3-\4-\5-\6")
| eval mac_dot=replace(mac_clean, "(....)(....)(....)", "\1.\2.\3")
| fields mac_clean mac_colon mac_hyphen mac_dot
| eval search_string="\"" . mac_clean . "\" OR \"" . mac_colon . "\" OR \"" . mac_hyphen . "\" OR \"" . mac_dot . "\""
| table search_string
| map search="search index=main sourcetype=syslog ($search_string$) | table _time host _raw"

[ITWhisperer]

Your first replace effectively reduces the string to 8 characters and the subsequent replaces are expecting 12 characters so the replaces fail. Also, using map is tricky at the best of times, perhaps you could try something like this

index=main sourcetype=syslog [| makeresults
| eval input_mac="48a4.93b9.xxxx"
| eval mac_clean=lower(replace(input_mac, "[^0-9A-Fa-f]", ""))
| eval mac_colon=replace(mac_clean, "(..)(..)(..)(..)", "\1:\2:\3:\4:")
| eval mac_hyphen=replace(mac_clean, "(..)(..)(..)(..)", "\1-\2-\3-\4-")
| eval mac_dot=replace(mac_clean, "(....)(....)", "\1.\2.")
| eval query=mvappend(mac_colon, mac_hyphen, mac_dot)
| mvexpand query
| table query]
| table _time host _raw"

[anthonyi · Accepted solution]

Thank you! That gave me the proper direction to go!

My final, validated version is...

index=main sourcetype=syslog
[
| makeresults
| eval input_mac="48a4.93b9.xxxx"
| eval mac_clean=lower(replace(input_mac, "[^0-9A-Fa-f]", ""))
| where len(mac_clean)=12
| eval mac_colon=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1:\2:\3:\4:\5:\6")
| eval mac_hyphen=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1-\2-\3-\4-\5-\6")
| eval mac_dot=replace(mac_clean, "(....)(....)(....)", "\1.\2.\3")
| eval query=mvappend(mac_clean, mac_colon, mac_hyphen, mac_dot)
| mvexpand query
| where isnotnull(query)
| fields query
| format
]
| table _raw

[anthonyi]

Just a quick update to my final saved search, which allows a simple double-click and paste of a new MAC in any format, but will never return a result initially. I am using this as a report.

index=main sourcetype=syslog
[
| makeresults
| eval input_mac="INPUT_HERE"
| eval mac_clean=lower(replace(input_mac, "[^0-9A-Fa-f]", ""))
| where len(mac_clean)=12
| eval mac_colon=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1:\2:\3:\4:\5:\6")
| eval mac_hyphen=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1-\2-\3-\4-\5-\6")
| eval mac_dot=replace(mac_clean, "(....)(....)(....)", "\1.\2.\3")
| eval query=mvappend(mac_clean, mac_colon, mac_hyphen, mac_dot)
| mvexpand query
| where isnotnull(query)
| fields query
| format
]
| table _raw