For java sdk, output mode as json, I am getting fields sent from splunk and their values as json. But how ever is the order of fields in the table statement | table field1, field2 or | table field2, field1 The order of fields I get in the java side is the same - and i need the order the same way as I has specified in the query after table What should be done to get this way ... View more

I have downloaded SplunkJavaAgent and set it to run in eclipse by giving arguments for javaagent during Tomcat startup and am getting events in Splunk through TCP but not what I want. Following are the challenges I have. *1. I would like to have method names, execution timings, call trace, application/thread stalls, errors/exceptions/throwables 2. Heap analysis * I am not sure if I am doing right in splunkagent.properties - giving the details of the file. agent.app.name=Tomcat agent.app.instance=MyJVM agent.userEventTags=key1=value1,key2=value2 splunk.transport.internalQueueSize=10000 splunk.transport.impl=com.splunk.javaagent.transport.SplunkTCPTransport splunk.transport.tcp.host=localhost splunk.transport.tcp.port=5150 splunk.transport.tcp.maxQueueSize=5MB splunk.transport.tcp.dropEventsOnQueueFull=false trace.whitelist=com/myinit trace.methodEntered=true trace.methodExited=true trace.classLoaded=true trace.errors=true trace.hprof=false trace.hprof.tempfile=mydump.hprof trace.hprof.frequency=6 trace.jmx=true trace.jmx.configfiles=jmx trace.jmx.default.frequency=6 ** And the output I get is ** vax.management.openmbean.CompositeType(name=java.lang.management.MemoryUsage,items=((itemName=committed,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long)),(itemName=init,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long)),(itemName=max,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long)),(itemName=used,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long)))),contents={committed=15466496, init=12582912, max=67108864, used=15221296})}), [Survivor Space]=javax.management.openmbean.CompositeDataSupport(compositeType=javax.management.openmbean.CompositeType(name=Map ,items=((itemName=key,itemType=javax.management.openmbean.SimpleType(name=java.lang.String)),(itemName=value,itemType=javax.management.openmbean.CompositeType(name=java.lang.management.MemoryUsage,items=((itemName=committed,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long)),(itemName=init,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long)),(itemName=max,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long)),(itemName=used,itemType=javax.management.openmbean.SimpleType(name=java.lang.Long))))))),contents={key=Survivor Space, 3:43:08.024 PM 1365070388024 name=jmx event_id=splunkagent mbean_domain=java.lang mbean_property_name=Code Cache mbean_property_type=MemoryPool usageUsed=3579264 memManagerNames=[CodeCacheManager] usageInit=163840 memoryType=NON_HEAP peakUsageMax=33554432 usageMax=33554432 peakUsageCommitted=3604480 peakUsageUsed=3579264 colUsageMax= colUsageUsed= colUsageInit= name=Code Cache peakUsageInit=163840 colUsageCommitted= usageCommitted=3604480 appName=Tomcat appID=MyJVM key2=value2 key1=value1 ... View more

Hi, We are using SPlunk java sdk and it returns result in json format. We need _raw details also- so our Splunk query includes _raw data. The problem we are facing is- the resulting output- data is huge and is breaking beyond a point. We got to know that JSON data has a limit of 1,000,000 characters in length. Are there any suggestions on how we can circumvent this. We are using strus2, jquery ... View more

rex "(?i)\(ms\):(?P<duration>.+)" Query: sourcetype="mylog" | rex "(?i)\(ms\):(?P<duration>.+)" | eval epochtime=_time | sort epochtime | table epochtime,duration I am unable to figure out what is happening within the rex statement above. (ms):5.276144 (Data in log file comes in this format). I can understand that we're trying to catch "(ms):" in the rex command through " \(ms\): " but am not able to figure out the rest of it. Kindly help. This command is extremely slow in performance - would request what changes could be done to better the performance. ... View more