How to normalize MAC address format?

Found the answer, but not where I was expecting. It seems--correct me if I'm wrong--that SEDCMD does not work on events forwarded from another system. I moved my SEDCMD from the index host--where it was NOT working--to the forwarder, and presto! it came good.

This is not documented as far as I can see, unless it's buried somewhere in the discussion of the pipeline. I'm quite happy to subst the whole output from getmac.exe, since I throw away most of it and keep the mac address--the field extraction on the index server DOES work.

This would be nice to have in the windows app, so you can align mac addresses in a multi-platform shop. Also, if windows had utilities like sed built-in, none of this would be necessary since you could do it all in the script, like on a real OS.

Anyway, the complete solution if anyone is interested:

On windows host--input and rewrite

-- create $SPLUNKbinscriptsgetmac.cmd

@echo off
getmac.exe /nh

-- add an input to etcsystemlocalinputs.conf

[script://C:\Program Files\Splunk\bin\scripts\getmac.cmd]
disabled = false
interval = 60
sourcetype = getmac
index = my_index

-- add sedcmd to etcsystemlocalprops.conf

[getmac]
TRANSFORMS-routing=route_bering # added by forwarder config
SEDCMD=s/-/:/g

On indexer: field extraction

EXTRACT-macaddr = (?P<mac_addr>\w{2}:\w{2}:\w{2}:\w{2}:\w{2}:\w{2})

Result: maximum joy

19/08/2011 11:44:06.000 00:16:3E:23:E8:09 DeviceTcpip_{60AE15D3:02BD:4E10:8D86:D1FECF394DAB}
host=barents.remora.com.au sourcetype=getmac source=C:Program FilesSplunkbinscriptsgetmac.cmd mac_addr=00:16:3E:23:E8:09

This can be solved by a scripted lookup, and you can apply it to entire sources or sourcetypes. (Be sure to extract the mac as messy_mac or change that to your non-normalized-mac field name.)

bin/normalizemac.py

# MAC address normalization script
# Turns a MAC in any of the following formats:
#      000000000000
#      00 00 00 00 00 00
#      00.00.00.00.00.00
#      00-00-00-00-00-00
#
# Into 00:00:00:00:00:00 format.
#

import sys
import csv
import re

def to_dict(d):
#######################################################
# Given a list or tuple, return a dictionary that
# has each value set to the name of the key.
# e.g.:      ( 'foo', 'bar' )
# becomes:   { 'foo': 'foo', 'bar': 'bar' }
#######################################################
        ret = {}
        for i in d:
                ret[i] = i
        return ret

# Read
data = csv.DictReader(sys.stdin)
fields = data.fieldnames
write = csv.DictWriter(sys.stdout, fields)
write.writerow(to_dict(fields))

for row in data:
        output = {}
        input = row['input']
        m = re.search("([0-9a-fA-F]{2})[-.:\s]?([0-9a-fA-F]{2})[-.:\s]?([0-9a-fA-F]{2})[-.:\s]?([0-9a-fA-F]{2})[-.:\s]?([0-9a-fA-F]{2})[-.:\s]?([0-9a-fA-F]{2})", input)
        mac = m.group(1) + ":" + m.group(2) + ":" + m.group(3) + ":" + m.group(4) + ":" + m.group(5) + ":" + m.group(6)
        mac = mac.lower()
        output['input'] = input
        output['mac'] = mac
        write.writerow(output)

local/transforms.conf

[normalizemac]
external_cmd = normalizemac.py input mac
fields_list = input,mac

local/props.conf

[datastreamname]
LOOKUP-normalizemac = normalizemac input AS messy_mac OUTPUTNEW mac

Is there no simpler way to do this? Grappling with the same problem...

I tried this in props.conf but it didn't do anything:

SEDCMD-fixmac=s/-/:/g

This is index-time, which is fine...if it worked.

Input is from windows, which provides aa-bb-cc-dd-ee-ff