Network interface Naming problem

[chowell]

I am trying to graph BytesTotalPersec for the four interfaces on a particular server. The name of each interface is:

• Intel[R] Gigabit ET Quad Port Server Adapter
• Intel[R] Gigabit ET Quad Port Server Adapter _2
• Intel[R] Gigabit ET Quad Port Server Adapter _3
• Intel[R] Gigabit ET Quad Port Server Adapter _4

The index has the stats for all four interfaces, but in the Pick fields section, Name only contains one value and that value is Intel[R].

Thanks for the help.

--Carl

[woodcock]

You need to do your own field extraction (instead of allowing Splunk to do it automatically because it will stop at the first whitespace unless the whole thing is enclosed in double-quotes), with rex command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

[chowell]

I don't see a field extraction that matches Name, so I guess it's my own.

[mw]

Sorry, I meant: is there an app doing the field extractions (i.e. the Windows app), or are they your own?

[chowell]

Search....

[mw]

What app are you using?