Hello. I have my indexers indexing the results of iostat every few minutes.
rrqm/s wrqm/s r/s w/s rMB/s wMB/s avgrq-sz avgqu-sz await svctm
splunk_cold 0.00 0.00 10.16 173.12 0.32 0.68 11.17 0.15 0.77 0.19 splunk_hot 0.00 0.00 0.00 0.01 0.00 0.00 8.00 0.00 4.39 0.09
Is there a way I could run a search-report to display the stats for either Splunk_cold and or Splunk_hot with the data? How do you tell Splunk to recognize this table that comes from a log file?
Thanks
props.conf
[iostat]
KV_MODE = multi
I guess mulitkv is your friend, see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Multikv
You could also try to install the *NIX app, it has lots of such searches implemented.