Field Extraction on the command Netstat command?

[daniel333]

All,

So I am playing with the netstat feature in Splunk for Unix. There does not seem to be field extractions for the columns in Netstat.

Output look something like this from the netstat.sh command
Proto Recv-Q Send-Q LocalAddress ForeignAddress State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:49085 0.0.0.0:* LISTEN

Any idea where I could start with this?

[somesoni2]

Have a look at multikv command
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Multikv

usage

your base search | multikv

[brettbird80]

Thanks a lot for this suggestion! I was researching the same problem as the OP today for an urgent monitor. multikv worked perfectly and saved me hours of time!

[sundareshr]

You can create your own extraction. Make this change on the search head

*props.conf*

[appropriate_stanza_name]
FIELD_HEADER_REGEX=(proto.*)
HEADER_FIELD_DELIMITER=" "
FIELD_DELIMITER=" "