topic Is Splunk the right tool for ESXTOP? in Getting Data In

Is Splunk the right tool for ESXTOP?

dbeez — Thu, 13 Jun 2013 14:01:52 GMT

Hello All,

I'm outputting VMware esxtop data to a csv and was wondering if splunk was the right tool to index and use the data.

I've got esxtop dumping a csv with 30 minutes of data. The csv has a header row.

Each of the columns represents a metric/stat/counter being gathered.

The "events" in this case are timestamps of resource utilization/performance data.

Is splunk the right tool for this, or should I be looking elsewhere?

Thanks,
db

Re: Is Splunk the right tool for ESXTOP?

bmacias84 — Thu, 13 Jun 2013 17:03:29 GMT

Yes, Splunk can handle the data just fine, just build your extractions.

Re: Is Splunk the right tool for ESXTOP?

dbeez — Thu, 13 Jun 2013 18:50:11 GMT

Is there a way to do this automatically - there are thousands of columns.

I have a header row in csv format - can't I just tell extraction to follow the header row as far as field classification goes? Each non-header row follows the same regex pattern.

The way I see it now I have to manually create each field.

Apologies on my splunk illiteracy.

Re: Is Splunk the right tool for ESXTOP?

lguinn2 — Fri, 14 Jun 2013 05:46:41 GMT

You can do automatic field extraction based on the CSV headers, but it is a bit gawky. Here's the documentation on Extract fields from file headers

I hope this doesn't cause more questions than it answers, but feel free to post the questions here!