Splunk App for Unix and Linux: How to modify netstat.sh to show PID/Program name?

[dwadyka]

Hey Guys trying to modify netstat.sh to display the "PID/Program name" when I modify PRINTF the PID/Program name info shows up under "Proto" any ideas.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------
#HEADER='Proto  Recv-Q  Send-Q  LocalAddress                    ForeignAddress                  State        PID/Program name'
#HEADERIZE="BEGIN {print \"$HEADER\"}"
#PRINTF='{printf "%-5s  %6s  %6s  %-30.30s  %-30.30s  %-s\n   %s\n", $1, $2, $3, $4, $5, $6, $9}'
#FILL_BLANKS='($1=="udp") {$6=""}'
-------------------------------------------------------------------------------------------------------------------------------------------------------------------

Original code

#HEADER='Proto  Recv-Q  Send-Q  LocalAddress                    ForeignAddress                  State'
#HEADERIZE="BEGIN {print \"$HEADER\"}"
#PRINTF='{printf "%-5s  %6s  %6s  %-30.30s  %-30.30s  %-s\n", $1, $2, $3, $4, $5, $6}'
#FILL_BLANKS='($1=="udp") {$6=""}'

#if [ "x$KERNEL" = "xLinux" ] ; then
#        CMD='eval netstat -aenp 2>/dev/null | egrep "tcp|udp"'

[sbbadri · Accepted solution]

Try this,

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $7}'
FILL_BLANKS='($1=="udp") {$7="<n/a>"}'

replace - with space

[dwadyka]

Awesome...Thanks for the help. The below fixed it.

HEADER='Proto Recv-Q Send-Q LocalAddress---------------ForeignAddress--------------State--------------------------PID'
HEADERIZE="BEGIN {print \"$HEADER\"}"
PRINTF='{printf "%-5s %6s %6s %-30.30s %-30.30s %-s %36s\n", $1, $2, $3, $4, $5, $6, $9}'
FILL_BLANKS='($1=="udp") {$9=""}'

[sbbadri]

cool. can you accept or vote for the answer.

[dwadyka]

Got the PID but did not get the program name.