Hi Splunkers,
I'm not sure what I'm doing wrong maybe you guys can help me. I have a MAC field coming in from the Cisco Prime infrastructure in the correct format xx:xx:xx:xx. I built a dashboard to be able to search by MAC and get physical details about that specific MAC. I'm trying to be able to search using different MAC formats - "-", ":". I use the eval command within my search string without any luck.
index=dtna_network_ciscoprime ipAddress=$ipaddress$
| eval macAddress=replace(macAddress,"-",":")
| where
macAddress="$macaddress$"
| table ipAddress, macAddress, clientInterface, vendor, nt_host
My end goal is to be able to paste the MAC into the text box in any format ":", "-", "." and get the same results. Any help will be much appreciated.
... View more