So the output of hardware.sh (from the Unix app) is something like this:
CPU_TYPE Intel(R) Xeon(R) CPU E5630 @ 2.53GHz
CPU_CACHE 12288 KB
HARD_DRIVES sda (PERC H700) 816 GB; sdb (PERC H800) 18625 GB;
NIC_TYPE Broadcom NetXtreme II Gigabit
MEMORY_REAL 16426668 kB
MEMORY_SWAP 4096564 kB
Is there an easy way to get the key/value pairs into fields properly?
You're looking for a regular expression to parse out each line into a variable fieldname according to the key?
First, to get the variable fieldname, you need a props.conf and transforms.conf entry like in this question: http://splunk-base.splunk.com/answers/23409/dynamically-extract-field-names-from-multiline-event
Second, the regular expression would look something like this (untested):