Archive

Network interface Naming problem

chowell
Explorer

I am trying to graph BytesTotalPersec for the four interfaces on a particular server. The name of each interface is:

  • Intel[R] Gigabit ET Quad Port Server Adapter
  • Intel[R] Gigabit ET Quad Port Server Adapter _2
  • Intel[R] Gigabit ET Quad Port Server Adapter _3
  • Intel[R] Gigabit ET Quad Port Server Adapter _4

The index has the stats for all four interfaces, but in the Pick fields section, Name only contains one value and that value is Intel[R].

Thanks for the help.

--Carl

Tags (1)
0 Karma

woodcock
Esteemed Legend

You need to do your own field extraction (instead of allowing Splunk to do it automatically because it will stop at the first whitespace unless the whole thing is enclosed in double-quotes), with rex command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

0 Karma

chowell
Explorer

I don't see a field extraction that matches Name, so I guess it's my own.

0 Karma

mw
Splunk Employee
Splunk Employee

Sorry, I meant: is there an app doing the field extractions (i.e. the Windows app), or are they your own?

0 Karma

chowell
Explorer

Search....

0 Karma

mw
Splunk Employee
Splunk Employee

What app are you using?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!