Custom Fields / CPU Core count

[Brady Bednar]

Hello, I am trying to understand how to import new fields and have been messing with patterns test files and such but i am definately missing a piece of how to get the data i need after i run the scan. As I can't figure out how to retrun my values to allow me to run an import. Currently the CPU count that is default isn't working right as we have a lot of hosts that have the same physical id as the cpu id and as thus only counts as 1 cpu. i see that the patter file uses the command "egrep '^(model name|cpu MHz|[pP]rocessor|physical id|cpu cores)' /proc/cpuinfo" but hypothethically what if i wanted to use egrep ^processor\\s /proc/cpuinfo | uniq | wc -l to count cpu per say or something like it. How can i get these results and pass it along?

So for example my server returns this on your command

{noformat}

processor : 0
model name : Intel(R) Xeon(R) Platinum 8260 CPU @ 2.40GHz
cpu MHz : 2400.000
physical id : 0
cpu cores : 4
processor : 1
model name : Intel(R) Xeon(R) Platinum 8260 CPU @ 2.40GHz
cpu MHz : 2400.000
physical id : 0
cpu cores : 4
processor : 2
model name : Intel(R) Xeon(R) Platinum 8260 CPU @ 2.40GHz
cpu MHz : 2400.000
physical id : 0
cpu cores : 4
processor : 3
model name : Intel(R) Xeon(R) Platinum 8260 CPU @ 2.40GHz
cpu MHz : 2400.000
physical id : 0
cpu cores : 4

{noformat}

but insight only counts it as 1 cpu when i need it to be 4 and also i will eventually need a total core count (so 16) as a custm field but don't know where to start

I tried loking around but the custom examples documentation is a little detailed and also we are on version 2.29.0 of discovery so cant use the 3.x.

Or is there a better way to know how I can make a field and tie in the results. Sorry if i am missing something easy I am just banging my head and think i am too close to the fire.would be happy to give more details if needed.

TLDR: I need help getting the output of this command to a custom field value

{code}

egrep ^processor\\s /proc/cpuinfo | uniq | wc -l

{code}

[Brady Bednar · Accepted solution]

i think i got this figured out. had to use extended information and was a challange as i was on 2.29.0 and both examples are from 3.0 but i think i got it

[Brady Bednar]

bump