Hi,
I have recently refactored two searches using post processing. From this:
eventtype=mlc sourcetype=sun_jvm host=$host_token$ service_name=$service_name_token$ | eval full_gc_value=if(isnotnull(full_gc_duration),100,null) | eval cms_value=if(isnotnull(cms_init_mark_duration),100,null) | timechart fixedrange=false bins=2000 max(after_gc) as total_mem_after_gc, max(max_gc) as max_memory, sum(par_new_duration) as ParNew, max(full_gc_value) as Full_GC, max(cms_value) as CMS eventtype=mlc sourcetype=sun_jvm host=$host_token$ service_name=$service_name_token$ | stats min(relative_time) as start, max(relative_time) as stop, sum(par_new_duration) as par_new_duration, sum(cms_init_mark_duration) as cms_init_mark_duration, sum(cms_remark_duration) as cms_remark_duration, sum(full_gc_duration) as full_gc_duration by service_name | eval seconds_in_range = stop - start | eval cms = cms_init_mark_duration + cms_remark_duration | eval "%_time_on_ParNew" = if(isnull(par_new_duration),0.00,round(par_new_duration/seconds_in_range,4)*100)."%" | eval "%_time_on_CMS" = if(isnull(cms),0.00,round(cms/seconds_in_range,4)*100)."%" | eval "%_time_on_Full_GC" = if(isnull(full_gc_duration),0.00,round(full_gc_duration/seconds_in_range,4)*100)."%" | fields service_name %_time_on_ParNew %_time_on_Full_GC %_time_on_CMS
To this:eventtype=mlc sourcetype=sun_jvm host=$host_token$ service_name=$service_name_token$ eval full_gc_value=if(isnotnull(full_gc_duration),100,null) | eval cms_value=if(isnotnull(cms_init_mark_duration),100,null) | timechart fixedrange=false bins=2000 max(after_gc) as total_mem_after_gc, max(max_gc) as max_memory, sum(par_new_duration) as ParNew, max(full_gc_value) as Full_GC, max(cms_value) as CMS stats min(relative_time) as start, max(relative_time) as stop, sum(par_new_duration) as par_new_duration, sum(cms_init_mark_duration) as cms_init_mark_duration, sum(cms_remark_duration) as cms_remark_duration, sum(full_gc_duration) as full_gc_duration by service_name | eval seconds_in_range = stop - start | eval cms = cms_init_mark_duration + cms_remark_duration | eval "%_time_on_ParNew" = if(isnull(par_new_duration),0.00,round(par_new_duration/seconds_in_range,4)*100)."%" | eval "%_time_on_CMS" = if(isnull(cms),0.00,round(cms/seconds_in_range,4)*100)."%" | eval "%_time_on_Full_GC" = if(isnull(full_gc_duration),0.00,round(full_gc_duration/seconds_in_range,4)*100)."%" | fields service_name %_time_on_ParNew %_time_on_Full_GC %_time_on_CMS
The only issue is that the time range of the search has changed from "All-time" to a specific range between 2011 and now. Unfortunately, this messes with my chart - the fixedrange=false no longer works, so everything goes into just one bucket. Is this the expected behavior?
↧