All Apps and Add-ons
Highlighted

Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Communicator

Hi guys,
I installed the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux.

I've a problem with the sourcetype = netstat . The fields of these events aren't automatically extracted.
If I search (in verbose mode): "index=os sourcetype=netstat" this is the result:
alt text
As you can see the fields: "Proto Recv-Q Send-Q LocalAddress ForeignAddress State" are not extracted.

Instead, if I search (in verbose mode): "index=os sourcetype=iostat" this is the result is fine:
alt text

Thanks

0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Communicator

Which distribution is it?

0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Communicator
  • Splunk Enterprise Server 6.5.2
  • Splunk App for Unix splunkappfor_nix 5.2.2
  • Splunk Add-on for *Nix SplunkTAnix 5.2.3
0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Communicator

We have the similar problem, check that the package sysstat is installed at the operation system.

0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Communicator

I checked and the sysstat package was already installed, also there are statistical logs in /var/log/sa/

The OS is Centos 6.8

0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Communicator

I've just figured out that that this is a duplicated post
The solution is to use the | multikv command in the query:

index=os sourcetype=netstat | multikv

View solution in original post

0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Path Finder

yeah! i like your command

0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Splunk Employee
Splunk Employee

To make this automatic, you can add the following to your props.conf on the search head:

[netstat]
KV_MODE = multi
0 Karma
Highlighted

Re: Splunk add-on for Unix and Linux - netstat, logs fields not extracted

New Member

I know this is an answered ticket but shouldn't it be fixed in the add-on so that it's automatically available to anyone without doing any manual configuration changes?

0 Karma