Hi, I have a single value visualization defined like this: <single> <title>ParNew duration as % of TPS duration</title> <search> <query>eventtype=mlc sourcetype=tps host=$host_token$ | ... | eval par_new_%_of_tps = round(total_par_new_duration_ms/total_tps_duration_ms,2)*100 | fields par_new_%_of_tps</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <option name="drilldown">none</option> <option name="link.visible">false</option> <option name="classField">range</option> <option name="field">value</option> <option name="underLabel">Red >= 41, Orange 20-40, Green < 20</option> <option name="linkView">search</option> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option> <option name="rangeValues">[20,40]</option> <option name="showSparkline">0</option> <option name="showTrendIndicator">0</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="trendInterval">auto</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> The aim is to change the color based on the value according to thresholds defined in "rangeValues" [20,40]. This works for all values except 0, when the box goes red (it should be green). I guess this is because the "min" is set to 1, so if the value is below the range of 1-20, it goes to the wrong color. So should I set the min to be 0? Anyone know how? Thanks, John ... View more

Hi, I'm trying to log Full GC events which look like this in the GC log: 109897.407: [Full GC 109897.407: [CMS: 8807279K->8606400K(31073920K), 11.1930580 secs] 9069543K->8606400K(31418944K), [CMS Perm : 77354K->77350K(262144K)], 11.1931520 secs] [Times: user=11.20 sys=0.00, real=11.19 secs] My props.conf has this stanza: [sun_jvm] SHOULD_LINEMERGE = false DATETIME_CONFIG = CURRENT BREAK_ONLY_BEFORE = ^\d+\.\d+: category = Custom disabled = false pulldown_type = true EXTRACT-file = (?P<service_name>[^\/\\]*)$ in source EXTRACT-PAR = ^(?P<TIME_GC_TIMESTAMP>[^ ]*?)\s?(?P<relative_time>\d+\.\d+):\s\[GC.*\]\s(?P<before_gc>\d+)K->(?P<after_gc>\d+)K\((?P<max_gc>\d+).*real=(?P<par_new_duration>\d+\.\d+)\s EXTRACT-FGC = ^(?P<TIME_GC_TIMESTAMP>[^ ]*?)\s?(?P<relative_time>\d+\.\d+):\s\[Full GC.*\]\s(?P<before_gc>\d+)K->(?P<after_gc>\d+)K\((?P<max_gc>\d+)K.*\s(?P<full_gc_duration>\d+\.\d+) secs\] EXTRACT-CMS = ^(?P<TIME_GC_TIMESTAMP>[^ ]*?)\s?(?P<relative_time>\d+\.\d+):\s\[CMS-concurrent-sweep:\s.*real=(?P<cms_duration>\d+\.\d+)\s EXTRACT-CMS-MARK = ^(?P<TIME_GC_TIMESTAMP>[^ ]*?)\s?(?P<relative_time>\d+\.\d+):\s.*\[1\sCMS-initial-mark:[^,]+,\s(?P<cms_init_mark_duration>\d+\.\d+) secs\] EXTRACT-CMS-REMARK = ^(?P<TIME_GC_TIMESTAMP>[^ ]*?)\s?(?P<relative_time>\d+\.\d+):\s.*\[1\sCMS-remark:[^,]+,\s(?P<cms_remark_duration>\d+\.\d+) secs\] This works for quick GCs, but sometimes the GC takes a bit of time, so the first part of the line comes a few seconds before the rest. Namely, this appears first: 109897.407: [Full GC 109897.407: [CMS Then a few seconds later it gets finished. The trouble is, Splunk interprets this first bit as an event in its own right, and then puts the rest in a second event: : 8807279K->8606400K(31073920K), 11.1930580 secs] 9069543K->8606400K(31418944K), [CMS Perm : 77354K->77350K(262144K)], 11.1931520 secs] [Times: user=11.20 sys=0.00, real=11.19 secs] This screws up my graph, because it's no longer recognized as a Full GC. Is there any way to tell Splunk to wait until the whole line has been written? Thanks! John ... View more

Hi, I have a graph which is produced by this timechart command: timechart max(duration) as TPS_MAX, sum(par_new_duration) as ParNew, sum(cms_duration) as CMS, sum(full_gc_duration) as FULL_GC by operation This produces fields: "TPS_MAX: PREVIEW", "TPS_MAX: COMMIT", "TPS_MAX: CHECK_AND_RESERVE", "TPS_MAX: CHECK", "TPS_MAX: RESERVE", "ParNew: MLC_GC", "CMS: MLC_GC", "FULL_GC: MLC_GC" I need to assign a specific color to each field, like this: <option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000, "TPS_MAX: COMMIT":0x999900, "TPS_MAX: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX: CHECK":0x9900FF, "TPS_MAX: RESERVE":0x006600, "ParNew: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC: MLC_GC":0xff0000 }</option> However, the colors are not displayed. Does the colon in the field name break the field colors option? Thanks! John ... View more