Splunk Search

How to analyze raw metric data

huajieyangdbs
Observer

I am getting following PCF metric log every 15 seconds. How should I visualize these data?

I need to do a calculation base on these raw data, eg, in order to get disk usage i need to calculate disk / disk_quota.

```

Nov 20 2020 02:19:44 [0] [gauge@47450 name="disk" value="1.75566848e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="memory_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="disk_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="cpu" value="0.49678180215706796" unit="percentage"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="memory" value="1.43845562e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="absolute_usage" value="2.4535017473e+11" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="absolute_entitlement" value="1.446439661673e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="container_age" value="5.5075313206719e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="spike_end" value="1.605783762e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:44 [0] [gauge@47450 name="spike_start" value="1.605783717e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="memory" value="1.43845562e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="disk" value="1.75566848e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="memory_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="disk_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="cpu" value="0.42428616676912556" unit="percentage"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="absolute_usage" value="2.45413034799e+11" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="absolute_entitlement" value="1.4468287599674e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="container_age" value="5.5090128695397e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="spike_start" value="1.605783717e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:19:59 [0] [gauge@47450 name="spike_end" value="1.605783762e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="memory_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="disk_quota" value="1.073741824e+09" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="cpu" value="0.4235502016391223" unit="percentage"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="memory" value="1.43845562e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="disk" value="1.75566848e+08" unit="bytes"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="container_age" value="5.5105736349872e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="absolute_usage" value="2.45479141051e+11" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="absolute_entitlement" value="1.4472386628647e+13" unit="nanoseconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="spike_start" value="1.605783717e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"
Nov 20 2020 02:20:14 [0] [gauge@47450 name="spike_end" value="1.605783762e+09" unit="seconds"] app_id="00522f59-af6f-4b41-bdb8-afd804098ba3"

```

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| extract
| where name="disk" or name="disk_quota"
| rex "(?<_time>^.{20})"
| eval _time=strptime(_time,"%b %d %Y %H:%M:%S")
| eval {name}=value*1
| stats values(disk) as disk values(disk_quota) as disk_quota by _time
| eval usage=disk/disk_quota
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...