How to use mvexpand to create multiple events with different times?

[bdruth]

I have an event, from JVM garbage collection activity, and it is logged with a timestamp representing the beginning of the GC activity. It also logs a field indicating the time elapsed during the GC activity. Since the event provides me a value indicating state of the memory before/after the GC activity, I'd like to create two events (presumably w/ mvexpand) where the first event has a "starting" value tied to the event's original timestamp, and the second event has an "ending" value tied to the original timestamp + elapsed time.

The event looks like this:

2016-12-07T12:18:02.442-0600: 56139.087: [GC2016-12-07T12:18:02.442-0600: 56139.087: [ParNew: 5536635K->167110K(6051264K), 0.1446960 secs] 8439996K->3080936K(9420224K), 0.1449360 secs] [Times: user=0.48 sys=0.00, real=0.14 secs]

In this case, I'm primarily interested in the information contained in the [ParNew:...] piece of the event. So, I guess I want to transform this into two events

_time,heap_young_used
2016-12-07T12:18:02.442-0600,5536635
2016-12-07T12:18:02.586-0600,167110

I could throw up a few things I've tried, but I'm basically stumped here. Not feeling like I'm getting any closer to figuring this out. Or maybe it's not possible.

[sundareshr · Accepted solution]

Give this a shot

base search | rex field=x "ParNew:\s?(?<heap_start>\d+)\w\-\>(?<heap_end>\d+)\S+\s?(?<elapsed_time>\S+)" | eval end=_time+elapsed_time | eval events=_time.",".heap_start.";".end.",".heap_end | makemv events delim=";" | mvexpand events | rex field=events "(?<_time>[^,]+),(?<heap>.*)" | table _time heap