I want to format nicely the fields or events at search time.
by example :
US phone : 11122223333 to (111) 222-3333
ipv4 : 1-2-3-4 to 1.2.3.4
credit card : 43431111222233334444 to 4343-1111-2222-3333-4444
You can use the rex command on any field, define macros.
If needed you can also use the SEDCMD to format the events at index time (but this will be definitive)
please replace the field by the one needed, and update the regex based on your needs.
mysearch | eval phone=1112223333 | rex field=phone mode=sed "s/(\d{3})(\d{3})(\d{4})/(\1) \2-\3/g" | table phone
mysearch | eval ip="1-2-133-4" | rex field=ip mode=sed "s/(\d{1,3})-(\d{1,3})-(\d{1,3})-(\d{1,3})/\1.\2.\3.\4/g" | table ip
it can be improved, ip block should be <= 255
mysearch | eval card="43431111222233334444" | rex field=card mode=sed "s/(43\d{2})(\d{4})(\d{4})(\d{4})(\d{4})/\1-\2-\3-\4-\5/g" | table card
this one will only match credit cards starting with 43.
You can use the rex command on any field, define macros.
If needed you can also use the SEDCMD to format the events at index time (but this will be definitive)
please replace the field by the one needed, and update the regex based on your needs.
mysearch | eval phone=1112223333 | rex field=phone mode=sed "s/(\d{3})(\d{3})(\d{4})/(\1) \2-\3/g" | table phone
mysearch | eval ip="1-2-133-4" | rex field=ip mode=sed "s/(\d{1,3})-(\d{1,3})-(\d{1,3})-(\d{1,3})/\1.\2.\3.\4/g" | table ip
it can be improved, ip block should be <= 255
mysearch | eval card="43431111222233334444" | rex field=card mode=sed "s/(43\d{2})(\d{4})(\d{4})(\d{4})(\d{4})/\1-\2-\3-\4-\5/g" | table card
this one will only match credit cards starting with 43.