Hi - this solution is a close approche - since we do not evaluate NativeMem Values for those instances we do not find a GC Cycle Event (=> no MemUsed Value for those instances).
index=Index_a
| regex _raw="(?ms)<gc-end id=\"\d+\" type=\"global\""
| rex field=_raw "(?ms)<gc-end id=\"\d+\" type=\"global\".*?<mem type=\"tenure\" free=\"(?<MemFree>\d+)\" total=\"(?<MemTotal>\d+)\" percent=\"(?<MemPercent>\d+)\".*"
| rex field=source "^/PATH/[^/]+/(?<ServiceId>[^/]+)/"
| eval MemUsed = (MemTotal - MemFree)/1024/1024
| eval Instance = host."_".ServiceId
| bucket _time span=5m
| join usetime=true type=inner Instance [
search index=Index_b
| rex field=_raw "^(\S+\s+){10}(?<NativeMem>\d+).*/PATH/(?<envid>[^/]+)/(?<ServiceId>[^/]+)/java/jre/bin/java[^\n]+-Xmx(?<MaxMemory>\d+)"
| eval NativeMem = NativeMem/1024
| eval Instance = host."_".ServiceId
| dedup Instance, NativeMem, MaxMemory
| bucket _time span=5m
]
| stats max(*) as * by _time Instance
| timechart span=5m max(NativeMem) as NativeMem, max(MaxMemory) as MaxMemory,max(MemUsed) as MemUsed by Instance
| filldown
... View more