| makeresults | eval A=" North|WidgetA|1000### South|WidgetA|2000### East|WidgetA|1000### West|WidgetA|300### North|WidgetB|200### South|WidgetC|20### East|WidgetC|150### West|WidgetB|300###" | makemv delim="###" A | mvexpand A | rex field=A "^(?<Region>[^|]+)\|(?<Widget>[^|]+)\|(?<Sales>[^|]+)" | stats sum(Sales) as Sales by Widget,Region | table Widget, Region,Sales Creates a table with unique widget, region pairs as rows, sum(sales) as a metric. Expected X axis with widget names (WidgetA, WidgetB, WidgetC), Y axis as region names (North, South, East, West), bubble size as sum(Sales). Observed all the bubbles at 0,0 and both X and Y axis is numeric. One other answer suggested adding <option name="charting.axisX">category</option> <option name="charting.axisY">category</option> Would specify the non-numeric option, but didn't work for me. The few answers for Bubble (I guess Scatter will be the same) was from way back, tried them but didn't work. In desperation I tried <option name="charting.axisX">Widget</option> <option name="charting.axisY">Region</option> too, but to no avail... ... View more

Hi, I set up a forwarder, the receiver, the index on the receiving side, and configured the inputs.conf on the forwarder as: [monitor:///data00/skaushik/cov-platform/config/system.properties] sourcetype = config_file [monitor:///data00/skaushik/cov-platform/config/cim.properties] sourcetype = config_file [monitor:///data00/skaushik/cov-platform/config/web.properties] sourcetype = config_file [monitor:///data00/skaushik/cov-platform/config/pgpass] sourcetype = config_file [monitor:///data00/skaushik/cov-platform/database/postgresql.conf] sourcetype = config_file [monitor:///data00/skaushik/cov-platform/logs/catalina.out] [monitor:///data00/skaushik/cov-platform/logs/gc.log*] sourcetype = gcg1.log [monitor:///data00/skaushik/cov-platform/logs/cim.log*] sourcetype = cimlog4j ignoreOlderThan=1d [monitor:///data00/skaushik/cov-platform/logs/catalina.log*] ignoreOlderThan=1d [monitor:///data00/skaushik/cov-platform/logs/performanceLog.log*] ignoreOlderThan=1d [monitor:///data00/skaushik/cov-platform/logs/usageLog.log*] ignoreOlderThan=1d [monitor:///data00/skaushik/cov-platform/database/pg_log/postgresql*] ignoreOlderThan=1d So the forwarder seems to work- to some extent... ---the sourcetypes are picked up by the receiver, and parsed according to the props.conf definitions - check ---I expected the small config files (*.properties, pgpass) appear at once- none of them do. ---I expected catalina.out and gc.log would appear at once (from the beginning of the file) -they have only limited number of events indexed. ---I expected the monitored files with ignoreOlderThan=1d appear in full at once -they don't seem to. If the file is younger than a day, it should appear full-it doesn't the gc.log events started to appear after a day, and even then is about 3 event less than 10% 8000/en-US/manager/search/licenseusage shows minimal ~0 usage. The files are below 1M How can I monitor what is actually being detected and sent? ... View more