Consecutive Full GC events from logs

[jgfchan]

Hi,

I'm trying to capture and report if in my log file I have say 5 consecutive matches for "Full GC" string. Any ideas how this can be done?

1302251.495: [Full GC [PSYoungGen: 577792K->365750K(638080K)] [PSOldGen: 1398102K->1398102K(1398144K)] 1975894K->1763852K(2036224K) [PSPermGen: 294429K->294
429K(524288K)], 5.4328410 secs] [Times: user=5.43 sys=0.00, real=5.43 secs]
1302265.517: [Full GC [PSYoungGen: 577792K->337661K(638080K)] [PSOldGen: 1398102K->1398098K(1398144K)] 1975894K->1735759K(2036224K) [PSPermGen: 294432K->294
378K(524288K)], 6.2223600 secs] [Times: user=6.22 sys=0.00, real=6.23 secs]
1302280.047: [Full GC [PSYoungGen: 577792K->363585K(638080K)] [PSOldGen: 1398098K->1398098K(1398144K)] 1975890K->1761683K(2036224K) [PSPermGen: 294380K->294
1298541.522: [GC-- [PSYoungGen: 577792K->577792K(638080K)] 1975767K->1975935K(2036224K), 1.2989880 secs] [Times: user=2.41 sys=13.43, real=1.30 secs]
1298542.822: [Full GC [PSYoungGen: 577792K->146370K(638080K)] [PSOldGen: 1398143K->1398143K(1398144K)] 1975935K->1544513K(2036224K) [PSPermGen: 294899K->294
899K(524288K)], 5.6393920 secs] [Times: user=5.63 sys=0.00, real=5.64 secs]
1298560.898: [Full GC [PSYoungGen: 577792K->152374K(638080K)] [PSOldGen: 1398143K->1398143K(1398144K)] 1975935K->1550517K(2036224K) [PSPermGen: 294901K->294
901K(524288K)], 5.2398370 secs] [Times: user=5.23 sys=0.00, real=5.24 secs]
1298573.143: [Full GC [PSYoungGen: 577792K->153141K(638080K)] [PSOldGen: 1398143K->1398143K(1398144K)] 1975935K->1551284K(2036224K) [PSPermGen: 294906K->294
906K(524288K)], 5.2001080 secs] [Times: user=5.19 sys=0.00, real=5.20 secs]

[Richfez]

Edit: fixed rex. Several times.

Streamstats will probably be your friend, here. Try reading through this post, I think your answer is there and it should be very easy to adapt to your needs (see below, though, for a tiny bit of specific help). There's a good introductory blog post here and the official streamstats docs page here.

I'd also rex a field out of that if it's not already a field, it will make your life easier. A guess:

... myrootsearch | rex "\d{7}\.\d{3}: \[(?<my_control_string>[^\[]*)"

Then you'll have a field "my_control_string" that you can use very much like that post I link to.

If you need more help, please ask! It isn't apparent from your post what your Splunk skill level is. If this solves your problem, please upvote that linked answer and then post back with what you did so that other can benefit from this knowledge.

As a further note, there are other great examples to be found by using your favorite search engine on "splunk streamstats count sequential events".

[somesoni2]

These are one log entry or multiple entries(6 I believe)?