All Apps and Add-ons

Splunk App for Unix and Linux: How to modify netstat.sh to show PID/Program name?

dwadyka
Explorer

Hey Guys trying to modify netstat.sh to display the "PID/Program name" when I modify PRINTF the PID/Program name info shows up under "Proto" any ideas.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------
#HEADER='Proto  Recv-Q  Send-Q  LocalAddress                    ForeignAddress                  State        PID/Program name'
#HEADERIZE="BEGIN {print \"$HEADER\"}"
#PRINTF='{printf "%-5s  %6s  %6s  %-30.30s  %-30.30s  %-s\n   %s\n", $1, $2, $3, $4, $5, $6, $9}'
#FILL_BLANKS='($1=="udp") {$6=""}'
-------------------------------------------------------------------------------------------------------------------------------------------------------------------

Original code

#HEADER='Proto  Recv-Q  Send-Q  LocalAddress                    ForeignAddress                  State'
#HEADERIZE="BEGIN {print \"$HEADER\"}"
#PRINTF='{printf "%-5s  %6s  %6s  %-30.30s  %-30.30s  %-s\n", $1, $2, $3, $4, $5, $6}'
#FILL_BLANKS='($1=="udp") {$6=""}'

#if [ "x$KERNEL" = "xLinux" ] ; then
#        CMD='eval netstat -aenp 2>/dev/null | egrep "tcp|udp"'
1 Solution

sbbadri
Motivator

Try this,

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $7}'
FILL_BLANKS='($1=="udp") {$7="<n/a>"}'

replace - with space

View solution in original post

sbbadri
Motivator

Try this,

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $7}'
FILL_BLANKS='($1=="udp") {$7="<n/a>"}'

replace - with space

dwadyka
Explorer

Awesome...Thanks for the help. The below fixed it.

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $9}'
FILL_BLANKS='($1=="udp") {$9=""}'

sbbadri
Motivator

cool. can you accept or vote for the answer.

0 Karma

dwadyka
Explorer

Got the PID but did not get the program name.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...