Hi,
I've created the following field extraction and field transform in their respective files - props.conf and transforms.conf:
[convert_mac_address_from_msdhcp]
FORMAT = client_mac_address::$1-$2-$3-$4-$5-$6
REGEX = ,(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2}),$
[msdhcp]
REPORT-client_mac_address = convert_mac_address_from_msdhcp
When doing a search, 'client_mac_address' appears but with a value of '$1-$2-$3-$4-$5-$6' and not, for example, '00-56-89-23-44-22' as I would expect. If I change the FORMAT line in the transform to the following:
FORMAT = client_mac_address::$1
I get the first two alphanumeric characters returned as expected i.e 07, so why does it break if using multiple $n?
Can anyone tell me why this is not working?
... View more