https://community.splunk.com/t5/Getting-Data-In/Help-with-extracting-the-fields-and-related-data-from-vmstat/m-p/493458#M99868 <P>Hi All,</P> <P>Can you please help me to extract the fields and related data from vmstat logs which are coming into splunk,Below the logs lines:</P> <P>memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS<BR />7000 xx8 xxx5 9.4 90.6 1561978416 100.0 85616943 4002987866 3965557908 66831877 250 3251 11.04 9.04 27902.02 48.24 2132.66</P> Thu, 17 Feb 2022 00:14:22 GMT rohit1793 2022-02-17T00:14:22Z https://community.splunk.com/t5/Getting-Data-In/Help-with-extracting-the-fields-and-related-data-from-vmstat/m-p/493458#M99868 <P>Hi All,</P> <P>Can you please help me to extract the fields and related data from vmstat logs which are coming into splunk,Below the logs lines:</P> <P>memTotalMB memFreeMB memUsedMB memFreePct memUsedPct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS<BR />7000 xx8 xxx5 9.4 90.6 1561978416 100.0 85616943 4002987866 3965557908 66831877 250 3251 11.04 9.04 27902.02 48.24 2132.66</P> Thu, 17 Feb 2022 00:14:22 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-extracting-the-fields-and-related-data-from-vmstat/m-p/493458#M99868 rohit1793 2022-02-17T00:14:22Z https://community.splunk.com/t5/Getting-Data-In/Help-with-extracting-the-fields-and-related-data-from-vmstat/m-p/493459#M99869 <P>Are you looking for help interpreting the data, i.e., what each numerical field represents? Or are you looking for help with parsing into individual fields?</P> Tue, 29 Oct 2019 20:49:20 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-extracting-the-fields-and-related-data-from-vmstat/m-p/493459#M99869 rmmiller 2019-10-29T20:49:20Z https://community.splunk.com/t5/Getting-Data-In/Help-with-extracting-the-fields-and-related-data-from-vmstat/m-p/585367#M102993 <P>There is a command multikv, it works for tabled data like we get from Unix/Linux machines:</P><P>index=foo host=abc* sourcetype=vmstat<BR />| bucket _time span=5m<BR />| multikv fields<BR />| stats avg(memUsedPct) as MemoryUsed by host</P> Wed, 16 Feb 2022 14:42:17 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-extracting-the-fields-and-related-data-from-vmstat/m-p/585367#M102993 rohit1793 2022-02-16T14:42:17Z