# Extract MAC Address only from this text

**URL:** <https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136>\
**Category:** PowerShell Help\
**Created:** [August 4, 2017, 5:56am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136 "2017-08-04T05:56:26Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![vandrey-trindade](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/vandrey-trindade/32/198_2.png) [@vandrey-trindade](https://forums.powershell.org/u/vandrey-trindade)\
**Post date:** [August 4, 2017, 5:56am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/1 "2017-08-04T05:56:26Z")

</div>

Hi,

I want to extract the MAC address from this text:

```
srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6
```

I’ve tried to use .split(" ") and then Select-String ‘._:._:._:._:._:._’ but it leaves the MAC with two empty lines…  
Any better idea?

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [August 4, 2017, 6:04am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/2 "2017-08-04T06:04:09Z")

</div>

[Regular expressions](https://en.wikipedia.org/wiki/Regular_expression)

```
'srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6' -match '(([0-9a-f]{2}:){5}[0-9a-f]{2})'
$Matches[0]
```

---

<div class="post-metadata">

**Author:** ![vandrey-trindade](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/vandrey-trindade/32/198_2.png) [@vandrey-trindade](https://forums.powershell.org/u/vandrey-trindade)\
**Post date:** [August 4, 2017, 6:11am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/3 "2017-08-04T06:11:05Z")

</div>

Olaf Soyk,

It didn’t worked…  
It shows the same text:

```
PS C:\> $MAC
srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ec:8d:78 [ether] em eth6
PS C:\> $MAC -match '(([0-9a-f]{2}:){5}[0-9a-f]{2})'
srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ec:8d:78 [ether] em eth6
```

What worked for me was this:

```
($MAC.split(" ") | Select-String '.*:.*:.*:.*:.*:.*').Line
```

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [August 4, 2017, 6:37am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/4 "2017-08-04T06:37:35Z")

</div>

hmmm … that’s strange … the match operator should at least produce a true or false. Did you try the code just like I posted it?

---

<div class="post-metadata">

**Author:** ![vandrey-trindade](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/vandrey-trindade/32/198_2.png) [@vandrey-trindade](https://forums.powershell.org/u/vandrey-trindade)\
**Post date:** [August 4, 2017, 6:41am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/5 "2017-08-04T06:41:25Z")

</div>

Olaf Soyk,

Sorry, it wasn’t working, but I started a new console and worked perfeclty! Thanks!

---

<div class="post-metadata">

**Author:** ![simbrook](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@simbrook](https://forums.powershell.org/u/simbrook)\
**Post date:** [August 4, 2017, 6:44am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/6 "2017-08-04T06:44:46Z")

</div>

This worked for me using Olaf’s suggestion

$mac = ‘srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6’  
$result = $mac -match ‘(([0-9a-f]{2}:){5}[0-9a-f]{2})’  
$Matches[0]  
$result

00:0c:ff:ed:8e:78  
True

---

<div class="post-metadata">

**Author:** ![js2010](https://avatars.discourse-cdn.com/v4/letter/j/ebca7d/32.png) [@js2010](https://forums.powershell.org/u/js2010)\
**Post date:** [August 4, 2017, 6:46am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/7 "2017-08-04T06:46:55Z")

</div>

```
'srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6' | 
foreach { -split $_ } | select -index 3

00:0c:ff:ed:8e:78
```

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [August 4, 2017, 7:43am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/8 "2017-08-04T07:43:46Z")

</div>

Neat! 🙂 But this works even shorter …

```
(‘srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6’ -split ’ ')[3]
```

---

<div class="post-metadata">

**Author:** ![js2010](https://avatars.discourse-cdn.com/v4/letter/j/ebca7d/32.png) [@js2010](https://forums.powershell.org/u/js2010)\
**Post date:** [August 4, 2017, 9:20am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/9 "2017-08-04T09:20:03Z")

</div>

You can just do

```
-split string
```
. It splits on whitespace by default.

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [August 4, 2017, 9:24am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/10 "2017-08-04T09:24:56Z")

</div>

you mean like this, right?

```
(-split ‘srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6’)[3]
```
  
hmmm … that does not safe that much and is (at least for me) harder to read. But thanks anyway. 😉

---

<div class="post-metadata">

**Author:** ![js2010](https://avatars.discourse-cdn.com/v4/letter/j/ebca7d/32.png) [@js2010](https://forums.powershell.org/u/js2010)\
**Post date:** [August 4, 2017, 12:14pm UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/11 "2017-08-04T12:14:33Z")

</div>

It is annoying that -split has to be in the front with no arguments, and in the back with a custom delimiter. Here’s a cut function I made, like the unix command. So you can just say “string | cut -f 3”:

```
function cut {
  param(
    [Parameter(ValueFromPipeline=$True)] [string]$inputobject,
    [string]$delimiter='\s+',
    [string[]]$field
  )

    process {
    if ($field -eq $null) { $inputobject -split $delimiter } else {
      ($inputobject -split $delimiter)[$field] }
  }
}
```

---

<div class="post-metadata">

**Author:** ![curtis-smith](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/curtis-smith/32/121_2.png) [@curtis-smith](https://forums.powershell.org/u/curtis-smith)\
**Post date:** [August 4, 2017, 4:38pm UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/12 "2017-08-04T16:38:02Z")

</div>

Simpler RegEx

```
'srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6' -match "\w\w:.*:\w\w"
$matches.values
```

Or the .Net way

```
[regex]::Match('srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6', "\w\w:.*:\w\w").value
```

---

<div class="post-metadata">

**Author:** ![random-commandline](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@random-commandline](https://forums.powershell.org/u/random-commandline)\
**Post date:** [August 4, 2017, 4:49pm UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/13 "2017-08-04T16:49:09Z")

</div>

Another way

```
$string = 'srv-ad.organization.local (192.168.46.30) em 00:0c:ff:ed:8e:78 [ether] em eth6'
$string -match '(\w{2}:)+\w{2}' ; $Matches[0]
```

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [August 4, 2017, 5:23pm UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/14 "2017-08-04T17:23:45Z")

</div>

Hmmm … call me picky but both of these approaches would even match “illegal” Mac addresses like “00:0c:ff:ed:8e:78:8e:78” or “00:0c:ff:ed:8y:78:xz:78” or “8y:78:xz:78”, right? 😉 😃

---

<div class="post-metadata">

**Author:** ![curtis-smith](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/curtis-smith/32/121_2.png) [@curtis-smith](https://forums.powershell.org/u/curtis-smith)\
**Post date:** [August 5, 2017, 10:27am UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/15 "2017-08-05T10:27:14Z")

</div>

You are right, it would. In context I saw no indication that it was user generated input, nor did I see request for content validation. I only saw request to pull the MAC from the string, which the regex accomplishes. If MAC format validation is required, then yes, it would be the more appropriate option.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:37pm UTC](https://forums.powershell.org/t/extract-mac-address-only-from-this-text/9136/16 "2024-05-16T20:37:47Z")

</div>