Splunk Search

Compiling stats for netstat output

tleyden
Explorer

Is it possible to take raw netstat input like this:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 10.181.112.50:34656     10.157.88.10:11210      ESTABLISHED 1001       121024     6925/sync_gateway
tcp        0      0 10.181.112.50:38528     10.109.187.75:11210     TIME_WAIT   1001       121039     6925/sync_gateway
tcp        0      0 10.181.112.50:39648     10.109.176.116:11210    ESTABLISHED 1001       121056     6925/sync_gateway
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 10.181.112.50:34656     10.157.88.10:11210      ESTABLISHED 1001       121024     6925/sync_gateway
tcp        0      0 10.181.112.50:38528     10.109.187.75:11210     TIME_WAIT   1001       121039     6925/sync_gateway
tcp        0      0 10.181.112.50:39648     10.109.176.116:11210    TIME_WAIT   1001       121056     6925/sync_gateway

and for each "reading" (separated by the Proto Recv-Q header) compute stats like:

Reading 1

ESTABLISHED: 2
TIME_WAIT: 1

Reading 2

ESTABLISHED: 1
TIME_WAIT: 2

If it would make it easier to put each netstat reading into it's own file, that would work too.

Tags (1)

woodcock
Esteemed Legend

I am assuming that each "reading" is a separate event. If so, you need the multikv command and this should work:

... | streamstats current=t count AS reading | multikv | stats count by reading State
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...