Splunk Search

Multikv not extracting data

theouhuios
Motivator

Hello

I am trying to input data of free -tm in splunk. The raw data would look like

              total       used       free     shared    buffers     cached
Mem:          3820       3570        250          0        649       1695

-/+ buffers/cache:       1226       2594

Swap:         2047          0       2047

Total:        5868       3570       2297

And the data is being transformed into (its not properly aligned here, but it splunk it's in perfect alignment)

Memtype     total       used       free     shared    buffers     cached
Mem          3820       3615        205          0        629       2083
bufferscache    0   901       2919

But its not extracting the data properly. Didn't work even with forceheader=1.

I don't know if this makes any difference or not, but here is the code

#! usr/bin/perl
use warnings;
use strict;

my (@version,$version,@file,$file);
$version = `uname -a`;
@version=split(' ',$version);
unless ($version[0] eq "Linux")
{
#print "Version Not Linux\n";
exit;
}
@file = `free -tm`;
$file[0]=~ s/\s+/Memtype\t    /;
$file[1]=~ s/://;
$file[2] =~ s/-\/\+\s+//;
$file[2] =~ s/\///;
$file[2] =~ s/:\s+/\t0\t/;
print $file[0];
print $file[1];
print $file[2];

Any help or suggestions??

Tags (1)
0 Karma
1 Solution

lpolo
Motivator

I would transform your script to create key=value pairs results as follow:

Memtype=Mem total=3820 used=3615 free=205 shared=0 buffers=629 cached=2083

I would include a time stamp:

12/14/2012 00:00:00 +0000 Memtype=Mem total=3820 used=3615 free=205 shared=0 buffers=629 cached=2083

Then, Splunk will automatically extract each field.

Lp

View solution in original post

lpolo
Motivator

I would transform your script to create key=value pairs results as follow:

Memtype=Mem total=3820 used=3615 free=205 shared=0 buffers=629 cached=2083

I would include a time stamp:

12/14/2012 00:00:00 +0000 Memtype=Mem total=3820 used=3615 free=205 shared=0 buffers=629 cached=2083

Then, Splunk will automatically extract each field.

Lp

lpolo
Motivator

It will be a good practice to include the time stamp in your script. In this way, you will have the time when the event was created.

0 Karma

theouhuios
Motivator

Splunk was able to extract it even without the timestamp. Thanks for help. 🙂

0 Karma

theouhuios
Motivator

How to I place the timestamp in it? Should this be done in the script itself? As of now the props.conf Date_config has been set to current. Would that be fine?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...