New comment on reddit

Here, for example, is the standard "unifying" eval I use to normalize MAC addresses:

| eval mac=upper(replace(mac,"\W","")) 

Which replaces any non-word ([a-zA-Z0-9]) characters with nothing – so it yoinks colons, etc – and makes it all uppercase

Of course – that presumes the MAC comes-in in something like one of the following formats:

  • xx:XX:00:xX:0X:x0
  • xxXX00xX0Xx0

And not something wacky like:

  • mac:0X..

Because yoinking the first colon in that format will just be wrong!

February 06, 2020 at 12:45PM
via reddit https://www.reddit.com/r/Splunk/comments/ezv6ay/newbie_question_about_a_splunk_capability/fgpsh52?utm_source=ifttt