Splunk Search

Compiling stats for netstat output

tleyden
Explorer

Is it possible to take raw netstat input like this:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 10.181.112.50:34656     10.157.88.10:11210      ESTABLISHED 1001       121024     6925/sync_gateway
tcp        0      0 10.181.112.50:38528     10.109.187.75:11210     TIME_WAIT   1001       121039     6925/sync_gateway
tcp        0      0 10.181.112.50:39648     10.109.176.116:11210    ESTABLISHED 1001       121056     6925/sync_gateway
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name
tcp        0      0 10.181.112.50:34656     10.157.88.10:11210      ESTABLISHED 1001       121024     6925/sync_gateway
tcp        0      0 10.181.112.50:38528     10.109.187.75:11210     TIME_WAIT   1001       121039     6925/sync_gateway
tcp        0      0 10.181.112.50:39648     10.109.176.116:11210    TIME_WAIT   1001       121056     6925/sync_gateway

and for each "reading" (separated by the Proto Recv-Q header) compute stats like:

Reading 1

ESTABLISHED: 2
TIME_WAIT: 1

Reading 2

ESTABLISHED: 1
TIME_WAIT: 2

If it would make it easier to put each netstat reading into it's own file, that would work too.

Tags (1)

woodcock
Esteemed Legend

I am assuming that each "reading" is a separate event. If so, you need the multikv command and this should work:

... | streamstats current=t count AS reading | multikv | stats count by reading State
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...