Splunk Search

Network interface Naming problem

chowell
Explorer

I am trying to graph BytesTotalPersec for the four interfaces on a particular server. The name of each interface is:

  • Intel[R] Gigabit ET Quad Port Server Adapter
  • Intel[R] Gigabit ET Quad Port Server Adapter _2
  • Intel[R] Gigabit ET Quad Port Server Adapter _3
  • Intel[R] Gigabit ET Quad Port Server Adapter _4

The index has the stats for all four interfaces, but in the Pick fields section, Name only contains one value and that value is Intel[R].

Thanks for the help.

--Carl

Tags (1)
0 Karma

woodcock
Esteemed Legend

You need to do your own field extraction (instead of allowing Splunk to do it automatically because it will stop at the first whitespace unless the whole thing is enclosed in double-quotes), with rex command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

0 Karma

chowell
Explorer

I don't see a field extraction that matches Name, so I guess it's my own.

0 Karma

mw
Splunk Employee
Splunk Employee

Sorry, I meant: is there an app doing the field extractions (i.e. the Windows app), or are they your own?

0 Karma

chowell
Explorer

Search....

0 Karma

mw
Splunk Employee
Splunk Employee

What app are you using?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...