All Apps and Add-ons

Splunk add-on for Unix and Linux - netstat, logs fields not extracted

faustf
Communicator

Hi guys,
I installed the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux.

I've a problem with the sourcetype = netstat . The fields of these events aren't automatically extracted.
If I search (in verbose mode): "index=os sourcetype=netstat" this is the result:
alt text
As you can see the fields: "Proto Recv-Q Send-Q LocalAddress ForeignAddress State" are not extracted.

Instead, if I search (in verbose mode): "index=os sourcetype=iostat" this is the result is fine:
alt text

Thanks

0 Karma
1 Solution

faustf
Communicator

I've just figured out that that this is a duplicated post
The solution is to use the | multikv command in the query:

index=os sourcetype=netstat | multikv

View solution in original post

0 Karma

mgaudie_splunk
Splunk Employee
Splunk Employee

To make this automatic, you can add the following to your props.conf on the search head:

[netstat]
KV_MODE = multi
0 Karma

mikaellindstrom
New Member

I know this is an answered ticket but shouldn't it be fixed in the add-on so that it's automatically available to anyone without doing any manual configuration changes?

0 Karma

faustf
Communicator

I've just figured out that that this is a duplicated post
The solution is to use the | multikv command in the query:

index=os sourcetype=netstat | multikv
0 Karma

vumanhtai
Path Finder

yeah! i like your command

0 Karma

amielke
Communicator

We have the similar problem, check that the package sysstat is installed at the operation system.

0 Karma

faustf
Communicator

I checked and the sysstat package was already installed, also there are statistical logs in /var/log/sa/

The OS is Centos 6.8

0 Karma

amielke
Communicator

Which distribution is it?

0 Karma

faustf
Communicator
  • Splunk Enterprise Server 6.5.2
  • Splunk App for Unix splunk_app_for_nix 5.2.2
  • Splunk Add-on for *Nix Splunk_TA_nix 5.2.3
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...