Quantcast
Viewing all articles
Browse latest Browse all 47296

Splunk add-on for Unix and Linux - netstat, logs fields not extracted

Hi guys, I installed the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux. I've a problem with the sourcetype = netstat . The fields of these events aren't automatically extracted. If I search (in verbose mode): "**index=os sourcetype=netstat**" this is the result: ![alt text][1] As you can see the fields: "Proto Recv-Q Send-Q LocalAddress ForeignAddress State" are not extracted. Instead, if I search (in verbose mode): "**index=os sourcetype=iostat**" this is the result is fine: ![alt text][2] Thanks [1]: /storage/temp/188315-screen-shot-2017-03-14-at-175340.png [2]: /storage/temp/188316-screen-shot-2017-03-14-at-175313.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>