@to4kawa @Sukisen1981 @gcusello - hey Guys any help here?? ... View more

Thanks @Keysofsandiego for your response but I am not really sure if i am looking this. So in simple terms what i want is a table with three columns - 1. req_content 2. Total count of this req_content (suppose in last 7 days) 3. Peak hour count of this req_content (suppose in last 7 days). Mainly the 1st and 3rd column and even if we don't get total count that's okay. The thing is i need to generate a report every 2 weeks with top 100 most visited pages and their peak hour count so that performance test team can have the latest data. ... View more

Thanks @to4kawa it worked 🙂 ... View more

Hi @Sukisen1981 yes that's correct. So i spoke to my Splunk admin about the source of this data and he said there is a script on Splunk which is pulling the logs from JMX server every 15 minutes so there is no source as such. I am investigating this more but yes it is very very unlikely that the CMS is happening every 15 minutes. Thank you so much for all the help you have provided. Atleast I got off to a start. 🙂 I will let you know once i find something. I am talking to application team as well. ... View more

Hi @Sukisen1981 - I tried the above code and this is the response i get where i get confused. Now does this mean that GC occurred in every 15 minutes? Count is 2 because of 2 servers. I am also speaking to the person who has enabled this logging to confirm the time interval and will let you know what he says. _time Old Gen Cleanup Young Gen Cleanup 2019-09-03 00:00:00 2 2 2019-09-03 00:15:00 2 2 2019-09-03 00:30:00 2 2 2019-09-03 00:45:00 2 2 2019-09-03 01:00:00 2 2 2019-09-03 01:15:00 2 2 2019-09-03 01:30:00 2 2 2019-09-03 01:45:00 2 2 2019-09-03 02:00:00 2 2 2019-09-03 02:15:00 2 2 ... View more

@Sukisen1981 - Ok that makes perfect sense. I think you have a brilliant way of explaining things. Thank you. So I am assuming the application is logging gc logs every 15 minutes because that is what I can see in Splunk Events. Now from these events suppose I want to find out when was the last GC occured, Can i use the latest event for that? And to calculate the frequency of GC triggers can i use this? The below events are for the same application where I am using two GC algos Event 1 - { [-] colCount: 439633 colTime: 6451976 gCDuration: 13 gCEnd: 293498632 gCID: 439633 gCStart: 293498619 gCThreadCount: 13 gcName: ParNew jvmDescription: Prod Server 1 mbean_domain: java.lang mbean_property_name: ParNew mbean_property_type: GarbageCollector memPools: [ [+] ] } Event 2 - { [-] colCount: 569 colTime: 545439 gCDuration: 7878 gCEnd: 293043228 gCID: 569 gCStart: 293035350 gCThreadCount: 13 gcName: ConcurrentMarkSweep jvmDescription: Prod Server 2 mbean_domain: java.lang mbean_property_name: ConcurrentMarkSweep mbean_property_type: GarbageCollector memPools: [ [+] ] } Can i just use this - index=jmx sourcetype=jmx host="Prod Server*" jvmDescription="*" mbean_domain="java.lang" mbean_property_type="GarbageCollector" | eval jvmgc=jvmDescription+"_"+gcName | eval TypeOfGC = if(gcName="ParNew", "Young Gen Cleanup", "Old Gen Cleanup") | chart count over host by TypeOfGC Will this give me a correct count of how many GC triggered of particular algo type? ... View more

@Sukisen1981 - Hi Sukisen, Thanks for your detailed response. This is really helpful. I have some events like this as well (below) where the gcDuration and other values comes as null. what does this mean? Does it mean that GC didn't happen? Also How does Splunk ingest this data? I mean it only ingest when GC occurs or is there anything else? because I can see events in Splunk every 15 minutes of interval. Also how do i calculate the frequency of GC using these logs like in a day how many times GC is happening? { [-] colCount: 4355 colTime: 35604114 gCDuration: null gCEnd: null gCID: null gCStart: null gCThreadCount: null gcName: ConcurrentMarkSweep jvmDescription: Prod Server 1 mbean_domain: java.lang mbean_property_name: ConcurrentMarkSweep mbean_property_type: GarbageCollector memPools: [ [+] ] } { [-] colCount: 4522 colTime: 32193425 gCDuration: null gCEnd: null gCID: null gCStart: null gCThreadCount: null gcName: ConcurrentMarkSweep jvmDescription: Prod Server 2 mbean_domain: java.lang mbean_property_name: ConcurrentMarkSweep mbean_property_type: GarbageCollector memPools: [ [+] ] } ... View more

@jpolvino Thank you for your response. mvexpand increases the eventcount. What i need is only unique sessions. Can i do dedup uniqueID after this. Will it be valid? Also this lookup command has to be supplied with OUTPUT fields. what should i write there? I only have one field in the lookup. ... View more

@gcusello Hi Giuseppe, Thanks for your swift response. I tried using lookup command but what should i be putting in the interesting fields? So my lookup only contains one field "productIdentifier" and fields I want is uniqueID which is present in the events so that I can dedup it afterwards to get the unique events. ... View more

Hi Vijeta, that's bang on! That's what i was needed. Thank you. ... View more

Just to add on to the above : I am using this but it is masking both the IP's but i only want to mask the 2nd IP which is at the end of that line - | rex field=_raw mode=sed "s/(\d+.\d+.+\d+.\d+)/****/g" ... View more

Brilliant Thank you ... View more

It worked thanks. ... View more

Hi Landen, Thanks for your response. Using this I am not able to see _time field. So basically my ultimate goal is to plot 2 charts (line graphs) in same splunk. Now the 2nd chart will consist of this index=os data. So i was thinking of exporting the PID and time values from this splunk to other splunk and then plot the chart against time. Does this make sense? ... View more