All Apps and Add-ons

Splunk App for Unix and Linux: How to modify netstat.sh to show PID/Program name?

dwadyka
Explorer

Hey Guys trying to modify netstat.sh to display the "PID/Program name" when I modify PRINTF the PID/Program name info shows up under "Proto" any ideas.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------
#HEADER='Proto  Recv-Q  Send-Q  LocalAddress                    ForeignAddress                  State        PID/Program name'
#HEADERIZE="BEGIN {print \"$HEADER\"}"
#PRINTF='{printf "%-5s  %6s  %6s  %-30.30s  %-30.30s  %-s\n   %s\n", $1, $2, $3, $4, $5, $6, $9}'
#FILL_BLANKS='($1=="udp") {$6=""}'
-------------------------------------------------------------------------------------------------------------------------------------------------------------------

Original code

#HEADER='Proto  Recv-Q  Send-Q  LocalAddress                    ForeignAddress                  State'
#HEADERIZE="BEGIN {print \"$HEADER\"}"
#PRINTF='{printf "%-5s  %6s  %6s  %-30.30s  %-30.30s  %-s\n", $1, $2, $3, $4, $5, $6}'
#FILL_BLANKS='($1=="udp") {$6=""}'

#if [ "x$KERNEL" = "xLinux" ] ; then
#        CMD='eval netstat -aenp 2>/dev/null | egrep "tcp|udp"'
1 Solution

sbbadri
Motivator

Try this,

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $7}'
FILL_BLANKS='($1=="udp") {$7="<n/a>"}'

replace - with space

View solution in original post

sbbadri
Motivator

Try this,

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $7}'
FILL_BLANKS='($1=="udp") {$7="<n/a>"}'

replace - with space

dwadyka
Explorer

Awesome...Thanks for the help. The below fixed it.

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $9}'
FILL_BLANKS='($1=="udp") {$9=""}'

sbbadri
Motivator

cool. can you accept or vote for the answer.

0 Karma

dwadyka
Explorer

Got the PID but did not get the program name.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...