I installed the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux.
I've a problem with the sourcetype = netstat . The fields of these events aren't automatically extracted.
If I search (in verbose mode): "index=os sourcetype=netstat" this is the result:
As you can see the fields: "Proto Recv-Q Send-Q LocalAddress ForeignAddress State" are not extracted.
Instead, if I search (in verbose mode): "index=os sourcetype=iostat" this is the result is fine:
We have the similar problem, check that the package sysstat is installed at the operation system.
I checked and the sysstat package was already installed, also there are statistical logs in /var/log/sa/
The OS is Centos 6.8
To make this automatic, you can add the following to your props.conf on the search head:
[netstat] KV_MODE = multi
I know this is an answered ticket but shouldn't it be fixed in the add-on so that it's automatically available to anyone without doing any manual configuration changes?