iostat data into splunk and searching

[Bryan_Rye]

Hello. I have my indexers indexing the results of iostat every few minutes.

       rrqm/s   wrqm/s     r/s     w/s    rMB/s    wMB/s avgrq-sz avgqu-sz   await  svctm

splunk_cold 0.00 0.00 10.16 173.12 0.32 0.68 11.17 0.15 0.77 0.19 splunk_hot 0.00 0.00 0.00 0.01 0.00 0.00 8.00 0.00 4.39 0.09

Is there a way I could run a search-report to display the stats for either Splunk_cold and or Splunk_hot with the data? How do you tell Splunk to recognize this table that comes from a log file?

Thanks

[landen99]

props.conf

[iostat]
KV_MODE = multi

[FritzWittwer_ol]

I guess mulitkv is your friend, see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Multikv

You could also try to install the *NIX app, it has lots of such searches implemented.