Is it possible to take raw netstat input like this:
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 10.181.112.50:34656 10.157.88.10:11210 ESTABLISHED 1001 121024 6925/sync_gateway
tcp 0 0 10.181.112.50:38528 10.109.187.75:11210 TIME_WAIT 1001 121039 6925/sync_gateway
tcp 0 0 10.181.112.50:39648 10.109.176.116:11210 ESTABLISHED 1001 121056 6925/sync_gateway
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 10.181.112.50:34656 10.157.88.10:11210 ESTABLISHED 1001 121024 6925/sync_gateway
tcp 0 0 10.181.112.50:38528 10.109.187.75:11210 TIME_WAIT 1001 121039 6925/sync_gateway
tcp 0 0 10.181.112.50:39648 10.109.176.116:11210 TIME_WAIT 1001 121056 6925/sync_gateway
and for each "reading" (separated by the Proto Recv-Q header) compute stats like:
ESTABLISHED: 2
TIME_WAIT: 1
ESTABLISHED: 1
TIME_WAIT: 2
If it would make it easier to put each netstat reading into it's own file, that would work too.
I am assuming that each "reading" is a separate event. If so, you need the multikv
command and this should work:
... | streamstats current=t count AS reading | multikv | stats count by reading State