topic Re: Field Extraction on the command Netstat command? in Splunk Search

Field Extraction on the command Netstat command?

daniel333 — Wed, 10 Aug 2016 22:51:10 GMT

All,

So I am playing with the netstat feature in Splunk for Unix. There does not seem to be field extractions for the columns in Netstat.

Output look something like this from the netstat.sh command
Proto Recv-Q Send-Q LocalAddress ForeignAddress State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:49085 0.0.0.0:* LISTEN

Any idea where I could start with this?

Re: Field Extraction on the command Netstat command?

sundareshr — Wed, 10 Aug 2016 23:14:17 GMT

You can create your own extraction. Make this change on the search head

*props.conf*

[appropriate_stanza_name]
FIELD_HEADER_REGEX=(proto.*)
HEADER_FIELD_DELIMITER=" "
FIELD_DELIMITER=" "

Re: Field Extraction on the command Netstat command?

somesoni2 — Wed, 10 Aug 2016 23:28:40 GMT

Have a look at multikv command
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Multikv

usage

your base search | multikv

Re: Field Extraction on the command Netstat command?

brettbird80 — Thu, 11 Aug 2016 15:35:56 GMT

Thanks a lot for this suggestion! I was researching the same problem as the OP today for an urgent monitor. multikv worked perfectly and saved me hours of time!