Hi Splunkers,
I'm not sure what I'm doing wrong maybe you guys can help me. I have a MAC field coming in from the Cisco Prime infrastructure in the correct format xx:xx:xx:xx. I built a dashboard to be able to search by MAC and get physical details about that specific MAC. I'm trying to be able to search using different MAC formats - "-", ":". I use the eval command within my search string without any luck.
index=dtna_network_ciscoprime ipAddress=$ipaddress$
| eval macAddress=replace(macAddress,"-",":")
| where
macAddress="$macaddress$"
| table ipAddress, macAddress, clientInterface, vendor, nt_host
My end goal is to be able to paste the MAC into the text box in any format ":", "-", "." and get the same results. Any help will be much appreciated.
@paulzharyuk
Can you please try following search?
index=dtna_network_ciscoprime ipAddress=$ipaddress$
| eval macAddress=replace(macAddress,"-",":") , macAddress=replace(macAddress,"\.",":")
| eval txtmacAddress="$macaddress$",txtmacAddress=replace(txtmacAddress,"-",":") , txtmacAddress=replace(txtmacAddress,"\.",":")
| where macAddress=txtmacAddress
| table ipAddress, macAddress, clientInterface, vendor, nt_host
My Sample Search:
| makeresults
| eval macAddress="10:0:1:1"
| append
[| makeresults
| eval macAddress="10.0.1.1" ]
| append
[| makeresults
| eval macAddress="10-0-1-1" ]
| eval macAddress=replace(macAddress,"-",":") , macAddress=replace(macAddress,"\.",":")
| eval txtmacAddress="10.0.1.1",txtmacAddress=replace(txtmacAddress,"-",":") , txtmacAddress=replace(txtmacAddress,"\.",":")
| where macAddress=txtmacAddress
Note: In sample search $macaddress$
= 10.0.1.1
Thanks