| max(used_wit) as maxwit, max(used_client_conn) as max_cc, max(db_1) as max_db1 by
_timeslice, appserver // add up all the WIT in use across the environment, count the number of appservers shown in the logs available
| sum (maxwit) as env_wit, count_distinct (appserver) as appserver_count by _timeslice // Divide the total # of work item threads in use over the number of appservers in use, express as a percentage
| env_wit / appserver_count / 100 as wit_pct
| fields wit_pct,_timeslice // Show the same time frames per day on the same graph
| compare with timeshift 1d 7
⇨
| timechart span=5m max(used_wit) as maxwit, max(used_client_conn) as max_cc, max(db_1) as max_db1 by appserver
| stats sum(maxwit) as env_wit, dc(appserver) as appserver_count by _time
| eval wit_pct = env_wit / appserver_count / 100
| fields _time wit_pct
| bin span=1d _time
Visualization > Line Chart
Please implement parse in props.conf and transforms.conf.
| makeresults
| eval _raw="[08 Jan 2020 03:00:44,715] [Scheduled-System-Tasks-Thread-13] [INFO] [System:System:] [Memory Monitor] Total JVM (B): 11538530304,Free JVM (B): 10589348776,Used JVM (B): 949181528,VSize (B): 37949321216,RSS (B): 12036202496,Used File Descriptors: 387,Used Work Item Threads: 0/100,Used Client Connections: 0/500,DB Client-Connection-Pool: 0/0/0/200/150/50,DB Job-Connection-Pool: 0/0/0/200/150/50,DB General-Connection-Pool: 4/4/0/200/150/50,Host/Appserver/Version: mmmm.rrrr.com/mmmmm-job/9.0.2.2"
| eval _raw=replace(_raw,",(?=\d+\])",".")
| extract pairdelim="]," kvdelim=":"
| rex "\[(?<time>\d\d \w+ \d{4} \d\d:\d\d:\d\d\.\d{3})\]"
| fields - _*
This is sample data.
... View more