Here's what I'm doing (the rex and following eval are new as of this morning):
| eval mac=upper(replace(mac,"\W","")) | rex field=mac mode=sed "s/(?=([A-F0-9]{2})+$/:/g" | eval mac=ltrim(mac,":") March 04, 2020 at 01:00PM
via reddit https://www.reddit.com/r/Splunk/comments/ezv6ay/newbie_question_about_a_splunk_capability/fjhbd1t?utm_source=ifttt