Compiling stats for netstat output

tleyden — Thu, 18 Jun 2015 00:16:12 GMT

Is it possible to take raw netstat input like this:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 10.181.112.50:34656     10.157.88.10:11210      ESTABLISHED 1001       121024     6925/sync_gateway
tcp        0      0 10.181.112.50:38528     10.109.187.75:11210     TIME_WAIT   1001       121039     6925/sync_gateway
tcp        0      0 10.181.112.50:39648     10.109.176.116:11210    ESTABLISHED 1001       121056     6925/sync_gateway
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 10.181.112.50:34656     10.157.88.10:11210      ESTABLISHED 1001       121024     6925/sync_gateway
tcp        0      0 10.181.112.50:38528     10.109.187.75:11210     TIME_WAIT   1001       121039     6925/sync_gateway
tcp        0      0 10.181.112.50:39648     10.109.176.116:11210    TIME_WAIT   1001       121056     6925/sync_gateway

and for each "reading" (separated by the Proto Recv-Q header) compute stats like:

Reading 1

ESTABLISHED: 2
TIME_WAIT: 1

Reading 2

ESTABLISHED: 1
TIME_WAIT: 2

If it would make it easier to put each netstat reading into it's own file, that would work too.

Re: Compiling stats for netstat output

woodcock — Sat, 20 Jun 2015 14:49:03 GMT

I am assuming that each "reading" is a separate event. If so, you need the multikv command and this should work:

... | streamstats current=t count AS reading | multikv | stats count by reading State

topic Compiling stats for netstat output in Splunk Search

Compiling stats for netstat output

Reading 1

Reading 2

Re: Compiling stats for netstat output