Here, for example, is the standard "unifying" eval I use to normalize MAC addresses:
| eval mac=upper(replace(mac,"\W",""))
Which replaces any non-word ([a-zA-Z0-9]) characters with nothing – so it yoinks colons, etc – and makes it all uppercase
Of course – that presumes the MAC comes-in in something like one of the following formats:
- xx:XX:00:xX:0X:x0
- xxXX00xX0Xx0
And not something wacky like:
mac:0X..
Because yoinking the first colon in that format will just be wrong!
February 06, 2020 at 12:45PM
via reddit https://www.reddit.com/r/Splunk/comments/ezv6ay/newbie_question_about_a_splunk_capability/fgpsh52?utm_source=ifttt