All,
So I am playing with the netstat feature in Splunk for Unix. There does not seem to be field extractions for the columns in Netstat.
Output look something like this from the netstat.sh command
Proto Recv-Q Send-Q LocalAddress ForeignAddress State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:49085 0.0.0.0:* LISTEN
Any idea where I could start with this?
Have a look at multikv command
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Multikv
usage
your base search | multikv
Thanks a lot for this suggestion! I was researching the same problem as the OP today for an urgent monitor. multikv worked perfectly and saved me hours of time!
You can create your own extraction. Make this change on the search head
*props.conf*
[appropriate_stanza_name]
FIELD_HEADER_REGEX=(proto.*)
HEADER_FIELD_DELIMITER=" "
FIELD_DELIMITER=" "