How to plot a bar chart to plot fields with KB,Bytes,MB and GB values?

[smdasim]

Hi ,

I have split the below log into key value paris ParEdenSpace_init=6.5 MB ParEdenSpace_Used=204.6 ParEdenSpace_Commited=1.7 GB and ParEdenSpace_Max=12.8 GB.

I have used below query to plot the data, however, the minParEdenSpaceUsed value is in KB but it is showing high value in the graph attached. How would I normalize the values before I plot the data and how to identify if the value is in bytes, MB or GB and then convert into standard GB or MB.

timechart span=1d min(ParEdenSpace_Used) as minParEdenSpaceUsed ,max(ParEdenSpace_Used) as  maxParEdenSpaceUsed,min(ParEdenSpace_Committed) as  minParEdenSpace_Committed,max(ParEdenSpace_Committed) as  maxParEdenSpace_Committed,,max(ParEdenSpace_Max) as  maxParEdenSpace_Max

Log file

2017-06-26T02:10:12 [INFO] [Thread: Security Console] Memory pool configuration:
                               |       Init |       Used |  Committed |        Max |
Code Cache                     |     2.4 MB |    46.8 MB |    48.9 MB |     240 MB |
Metaspace                      |    0 bytes |    90.3 MB |    92.2 MB |   -1 bytes |
Par Eden Space                 |     6.5 MB |   204.6 MB |     1.7 GB |    12.8 GB |
Par Survivor Space             |     768 KB |    0 bytes |   221.2 MB |     1.6 GB |
CMS Old Gen                    |     248 MB |     2.1 GB |     4.3 GB |      32 GB |

Many thanks for your response!
much appreciated

[elliotproebstel · Accepted solution]

To make it easy to understand (because you weren't sure if you'd convert to GB or MB above), I'll propose a way to normalize to bytes. This approach will split each relevant field into two pieces - val and multiplier. Based on the value of the field multiplier, a case statement multiplies the val by 1024 (to convert from KB), 1024*1024 (to convert from MB), 1024*1024*1024 (to convert from GB), or by no multiplier (to keep bytes in bytes).

| foreach minParEdenSpaceUsed, maxParEdenSpaceUsed, minParEdenSpace_Committed, maxParEdenSpace_Committed, maxParEdenSpace_Max 
    [ eval <<FIELD>>=split('<<FIELD>>', " ") 
    | eval val=mvindex(<<FIELD>>, 0), multiplier=mvindex(<<FIELD>>, 1) 
    | eval <<FIELD>>=case(multiplier="bytes", val, multiplier="KB", val*1024, multiplier="MB", val*1024*1024, multiplier="GB", val*1024*1024*1024) 
    | fields - val multiplier ]

If you wanted to convert to GB or MB, you'd adjust that math accordingly.

[smdasim]

Hi Ellio,
thank you very much and much appreciated for your help in this regard !
Regards,
smdasim

[smdasim]

sometime the same field value has value in KB,MB and GB .ParEdenSpace_Used can have values like 294.9 KB,2G B ,1.9 MB etc

[somesoni2]

If you do following search, what output (value) you get for various fields? Can you post some sample results from below query?

your base search | head 1 | table ParEdenSpace_Used ParEdenSpace_Used  ParEdenSpace_Committed ParEdenSpace_Committed ParEdenSpace_Max