Splunk Search

How to analyze raw metric data

huajieyangdbs
Observer

I am getting following PCF metric log every 15 seconds. How should I visualize these data?

I need to do a calculation base on these raw data, eg, in order to get disk usage i need to calculate disk / disk_quota.

```

Nov 20 2020 02:19:44 [0] [gauge@47450 name="disk" value="1.75566848e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="memory_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="disk_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="cpu" value="0.49678180215706796" unit="percentage"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="memory" value="1.43845562e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="absolute_usage" value="2.4535017473e+11" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="absolute_entitlement" value="1.446439661673e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="container_age" value="5.5075313206719e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="spike_end" value="1.605783762e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="spike_start" value="1.605783717e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="memory" value="1.43845562e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="disk" value="1.75566848e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="memory_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="disk_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="cpu" value="0.42428616676912556" unit="percentage"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="absolute_usage" value="2.45413034799e+11" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="absolute_entitlement" value="1.4468287599674e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="container_age" value="5.5090128695397e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="spike_start" value="1.605783717e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="spike_end" value="1.605783762e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="memory_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="disk_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="cpu" value="0.4235502016391223" unit="percentage"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="memory" value="1.43845562e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="disk" value="1.75566848e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="container_age" value="5.5105736349872e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="absolute_usage" value="2.45479141051e+11" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="absolute_entitlement" value="1.4472386628647e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="spike_start" value="1.605783717e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="spike_end" value="1.605783762e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"

```

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| extract
| where name="disk" or name="disk_quota"
| rex "(?<_time>^.{20})"
| eval _time=strptime(_time,"%b %d %Y %H:%M:%S")
| eval {name}=value*1
| stats values(disk) as disk values(disk_quota) as disk_quota by _time
| eval usage=disk/disk_quota
0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...