https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31668#M178122 <P>Search....</P> Wed, 22 Jun 2011 19:57:45 GMT chowell 2011-06-22T19:57:45Z https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31666#M178120 <P>I am trying to graph BytesTotalPersec for the four interfaces on a particular server. The name of each interface is:</P> <UL> <LI>Intel[R] Gigabit ET Quad Port Server Adapter</LI> <LI>Intel[R] Gigabit ET Quad Port Server Adapter _2</LI> <LI>Intel[R] Gigabit ET Quad Port Server Adapter _3</LI> <LI>Intel[R] Gigabit ET Quad Port Server Adapter _4</LI> </UL> <P>The index has the stats for all four interfaces, but in the Pick fields section, Name only contains one value and that value is Intel[R]. </P> <P>Thanks for the help.</P> <P>--Carl</P> Tue, 21 Jun 2011 14:17:15 GMT https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31666#M178120 chowell 2011-06-21T14:17:15Z https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31667#M178121 <P>What app are you using?</P> Tue, 21 Jun 2011 23:47:39 GMT https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31667#M178121 mw 2011-06-21T23:47:39Z https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31668#M178122 <P>Search....</P> Wed, 22 Jun 2011 19:57:45 GMT https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31668#M178122 chowell 2011-06-22T19:57:45Z https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31669#M178123 <P>Sorry, I meant: is there an app doing the field extractions (i.e. the Windows app), or are they your own?</P> Wed, 22 Jun 2011 20:18:04 GMT https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31669#M178123 mw 2011-06-22T20:18:04Z https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31670#M178124 <P>I don't see a field extraction that matches Name, so I guess it's my own.</P> Wed, 22 Jun 2011 20:20:37 GMT https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31670#M178124 chowell 2011-06-22T20:20:37Z https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31671#M178125 <P>You need to do your own field extraction (instead of allowing Splunk to do it automatically because it will stop at the first whitespace unless the whole thing is enclosed in double-quotes), with <CODE>rex</CODE> command:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex</A></P> Fri, 29 May 2015 00:16:00 GMT https://community.splunk.com/t5/Splunk-Search/Network-interface-Naming-problem/m-p/31671#M178125 woodcock 2015-05-29T00:16:00Z