My goal is to create an application list running from all servers in the form of table.
index=unix* host=* sourcetype=ps user="*" user=* NOT user=root
This way I am getting all the processes owned by nonroot users. I am trying to identify application name (web,app and db) apache(with /app/apache/"application name", jboss application name (/app/jboss/servers/"app name" and db name (pmon).
To all experts, is there any way to extract application/db name (web/app/db) using single search so that it can be presented as a table?
Hostname Webname Applicationname DBname
... | rex field=_source "/(?:(?:app/apache)|(?:app/jboss/servers)/(?<app>[^\]*)
index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]