A computer program product includes a computer readable storage medium containing computer code that, when executed by a computer, implements a method including receiving, by a memory device of the computing system, a log file, the log file comprising unsummarized metrics, the unsummarized metrics being related to a plurality of transactions performed by a program in the computing system, and a summarized metric, the summarized metric being related to the program, wherein the summarized metric comprises accumulated data from the plurality of transactions; selecting an unsummarized metric that reflects a distribution of the summarized metric among the plurality of transactions by a processing device of the computing system; and determining an amount of the summarized metric that belongs to a transaction of the plurality of transactions based on the selected unsummarized metric by the processing device of the computing system.