Hi all,
I'm using the winports app to index the result of the netstat -ano on my Windows servers. A few months ago the results displayed the various values under the LocalPort field, however, now only the first 3 ports show. I'm thinking that a Splunk upgrade may be the cause. Is there any way to correct this? There should be several more ports available.
Sample Event:
7/2/17
3:51:11.000 PM
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="135" Remo
teAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID=
"704"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="445" Remo
teAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID="
4"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="1433" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="sqlservr" PI
D="1284"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="3389" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PID
="1824"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="4445" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="enstart64" P
ID="1160"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="8089" Rem
oteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="splunkd" PID
="1596"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="10000" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="beremote" P
ID="2020"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="47001" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="System" PID
="4"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49152" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="wininit" PI
D="424"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49153" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PI
D="796"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="49154" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="svchost" PI
D="836"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="53108" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="lsass" PID=
"540"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="0.0.0.0" LocalPort="53130" Re
moteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="services" P
ID="532"
2017-07-02 15:51:11 Protocol="TCP" LocalAddress="127.0.0.1" LocalPort="1434" R
emoteAddress="0.0.0.0" RemotePort="0" State="LISTENING" ProcessName="sqlservr"
PID="1284"
LocalPort Values:
Values Count %
135 145 63.596%
80 79 34.649%
25 4 1.754%
Thanks,
James
Thanks. It works now. I had to change my sourcetype too as netstat was used elsewhere. There was actually no need to modify props.conf.
[script://.\bin\winports.bat]
disabled = 0
interval = 300
sourcetype = winports and not netstat - which is used by Unix app
source = Script:Winports
Thanks. It works now. I had to change my sourcetype too as netstat was used elsewhere. There was actually no need to modify props.conf.
[script://.\bin\winports.bat]
disabled = 0
interval = 300
sourcetype = winports and not netstat - which is used by Unix app
source = Script:Winports
Been messing with this today!
Create a props.conf file in your local directory with your input
Add this to your props.conf
[ winstat ]
CHARSET=UTF-8
SHOULD_LINEMERGE=true
disabled=false
redeploy app or restart forwarder depending on your setup.
I had to change the sourcetype to "winstat" since I am using netstat elsewhere. Both on the inputs.conf and props.conf.
I am now seeing the events being listed individually and all the fields are now populating.