Just a quick update to my final saved search, which allows a simple double-click and paste of a new MAC in any format, but will never return a result initially. I am using this as a report. index=main sourcetype=syslog [ | makeresults | eval input_mac="INPUT_HERE" | eval mac_clean=lower(replace(input_mac, "[^0-9A-Fa-f]", "")) | where len(mac_clean)=12 | eval mac_colon=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1:\2:\3:\4:\5:\6") | eval mac_hyphen=replace(mac_clean, "(..)(..)(..)(..)(..)(..)", "\1-\2-\3-\4-\5-\6") | eval mac_dot=replace(mac_clean, "(....)(....)(....)", "\1.\2.\3") | eval query=mvappend(mac_clean, mac_colon, mac_hyphen, mac_dot) | mvexpand query | where isnotnull(query) | fields query | format ] | table _raw
... View more