Splunk Search

Network interface Naming problem

chowell
Explorer

I am trying to graph BytesTotalPersec for the four interfaces on a particular server. The name of each interface is:

  • Intel[R] Gigabit ET Quad Port Server Adapter
  • Intel[R] Gigabit ET Quad Port Server Adapter _2
  • Intel[R] Gigabit ET Quad Port Server Adapter _3
  • Intel[R] Gigabit ET Quad Port Server Adapter _4

The index has the stats for all four interfaces, but in the Pick fields section, Name only contains one value and that value is Intel[R].

Thanks for the help.

--Carl

Tags (1)
0 Karma

woodcock
Esteemed Legend

You need to do your own field extraction (instead of allowing Splunk to do it automatically because it will stop at the first whitespace unless the whole thing is enclosed in double-quotes), with rex command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

0 Karma

chowell
Explorer

I don't see a field extraction that matches Name, so I guess it's my own.

0 Karma

mw
Splunk Employee
Splunk Employee

Sorry, I meant: is there an app doing the field extractions (i.e. the Windows app), or are they your own?

0 Karma

chowell
Explorer

Search....

0 Karma

mw
Splunk Employee
Splunk Employee

What app are you using?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...