Reporting

Consecutive Full GC events from logs

jgfchan
Engager

Hi,

I'm trying to capture and report if in my log file I have say 5 consecutive matches for "Full GC" string. Any ideas how this can be done?

1302251.495: [Full GC [PSYoungGen: 577792K->365750K(638080K)] [PSOldGen: 1398102K->1398102K(1398144K)] 1975894K->1763852K(2036224K) [PSPermGen: 294429K->294
429K(524288K)], 5.4328410 secs] [Times: user=5.43 sys=0.00, real=5.43 secs]
1302265.517: [Full GC [PSYoungGen: 577792K->337661K(638080K)] [PSOldGen: 1398102K->1398098K(1398144K)] 1975894K->1735759K(2036224K) [PSPermGen: 294432K->294
378K(524288K)], 6.2223600 secs] [Times: user=6.22 sys=0.00, real=6.23 secs]
1302280.047: [Full GC [PSYoungGen: 577792K->363585K(638080K)] [PSOldGen: 1398098K->1398098K(1398144K)] 1975890K->1761683K(2036224K) [PSPermGen: 294380K->294
1298541.522: [GC-- [PSYoungGen: 577792K->577792K(638080K)] 1975767K->1975935K(2036224K), 1.2989880 secs] [Times: user=2.41 sys=13.43, real=1.30 secs]
1298542.822: [Full GC [PSYoungGen: 577792K->146370K(638080K)] [PSOldGen: 1398143K->1398143K(1398144K)] 1975935K->1544513K(2036224K) [PSPermGen: 294899K->294
899K(524288K)], 5.6393920 secs] [Times: user=5.63 sys=0.00, real=5.64 secs]
1298560.898: [Full GC [PSYoungGen: 577792K->152374K(638080K)] [PSOldGen: 1398143K->1398143K(1398144K)] 1975935K->1550517K(2036224K) [PSPermGen: 294901K->294
901K(524288K)], 5.2398370 secs] [Times: user=5.23 sys=0.00, real=5.24 secs]
1298573.143: [Full GC [PSYoungGen: 577792K->153141K(638080K)] [PSOldGen: 1398143K->1398143K(1398144K)] 1975935K->1551284K(2036224K) [PSPermGen: 294906K->294
906K(524288K)], 5.2001080 secs] [Times: user=5.19 sys=0.00, real=5.20 secs]
0 Karma

Richfez
SplunkTrust
SplunkTrust

Edit: fixed rex. Several times.

Streamstats will probably be your friend, here. Try reading through this post, I think your answer is there and it should be very easy to adapt to your needs (see below, though, for a tiny bit of specific help). There's a good introductory blog post here and the official streamstats docs page here.

I'd also rex a field out of that if it's not already a field, it will make your life easier. A guess:

... myrootsearch | rex "\d{7}\.\d{3}: \[(?<my_control_string>[^\[]*)"

Then you'll have a field "my_control_string" that you can use very much like that post I link to.

If you need more help, please ask! It isn't apparent from your post what your Splunk skill level is. If this solves your problem, please upvote that linked answer and then post back with what you did so that other can benefit from this knowledge.

As a further note, there are other great examples to be found by using your favorite search engine on "splunk streamstats count sequential events".

somesoni2
Revered Legend

These are one log entry or multiple entries(6 I believe)?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...