All Apps and Add-ons

Extracting field for "Unix Add-on", netstat

broy32000
Explorer

Netstat sourcetype is displaying output like below.

Proto Recv-Q Send-Q LocalAddress ForeignAddress State
udp 0 0 :52311 *:
udp 12824 0 :631 *:
udp 0 0 172.18.127.203:123 :
udp 0 0 10.200.21.183:123 :
tcp 0 5 :1556 *: LISTEN
tcp 0 5 127.0.0.1:1557 : LISTEN
tcp 0 5 127.0.0.1:1567 : ESTABLISHED

Now I want to make “State” as a field whole value will be “LISTEN” or “ESTABLISHED” for example.

How do I do it?

woodcock
Esteemed Legend

You should just be able to call | multikv (this can be set to be done automatically for your sourcetype.

0 Karma

to4kawa
Ultra Champion

UPDATED:

| makeresults 
| eval _raw="Proto Recv-Q Send-Q LocalAddress         ForeignAddress State
udp        0      0 :52311               :
udp    12824      0 :631                 :
udp        0      0 172.18.127.203:123   :
udp        0      0  10.200.21.183:123   :
tcp        0      5               :1556  :              LISTEN
tcp        0      5      127.0.0.1:1557  :              LISTEN
tcp        0      5      127.0.0.1:1567  😘             ESTABLISHED"
| multikv
| eval State=if(State=="LISTEN" OR State=="ESTABLISHED",Proto." ".Recv_Q." ".Send_Q." ".LocalAddress." ".ForeignAddress." ".State,State)
| table Proto Recv_Q Send_Q LocalAddress ForeignAddress State
0 Karma

broy32000
Explorer

Thanks to4kawa. However, it does not fix my problem. Please note that the header of "netstat" command is: Proto Recv-Q Send-Q LocalAddress ForeignAddress State

Sub-set of values are:
udp 0 0 :52311 *:

udp 0 0 :53595 *:

-snip------------------
tcp 0 5 :1556 *: LISTEN
tcp 0 5 127.0.0.1:1557 : LISTEN
tcp 0 5 :13782 *: LISTEN
tcp 0 128 :22 *: LISTEN

I want to make "State" as a field so that I can get some details based on the values "State". One use case is to show the values of "LocalAddress" and time where "State" in "LISTEN" mode.

0 Karma

broy32000
Explorer

Note that output of "netstat" will go into splunk server every 5 minutes. It's not feasible to feed the entire output into eval _raw table. I think you solution suggests that entire output of "netstat" be fed to the table.

0 Karma

to4kawa
Ultra Champion
your_search

As a result, isn't the event _raw ?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...