Sorry, deleted after realizing that zindex just wanted a regex match. If we could make zindex allow specifying a substitution regex when deciding what string t

Sorry, deleted after realizing that zindex just wanted a regex match. If we could make zindex allow specifying a substitution regex when deciding what string to index under, that would work; your regex could be one that matches a MAC address and converts it to lowercase/strips punctuation, and then on the query side you could do the same with e.g. sed before piping to zq.