topic Re: how to retrieve memory value from GC log in Splunk Search

how to retrieve memory value from GC log

sangs8788 — Tue, 21 Nov 2017 10:32:42 GMT

I have below event from GC log,

2017-11-20T23:13:13.311-0800: 205957.353: [GC (Allocation Failure) 5152315K->4647798K(9100152K), 0.0800170 secs]

How do i retrieve the value for Allocation before GC ran, Allocation after GC ran, Heap memory and the GC time from the event ?

sangs8788 — Tue, 21 Nov 2017 10:39:28 GMT

I got the answer through regex.

niketn — Tue, 21 Nov 2017 10:40:26 GMT

Try the following regular expression:

\[([^\(]+)\(([^\)]+)\)[\)|\s]+(?<field1>\d+)K-\>(?<field2>\d+)K\((?<field3>\d+)K\), (?<field4>[\d|\.]+)

You can test your regular expression with sample log data on regex101.com