Is Splunk the right tool for ESXTOP?

[dbeez]

Hello All,

I'm outputting VMware esxtop data to a csv and was wondering if splunk was the right tool to index and use the data.

I've got esxtop dumping a csv with 30 minutes of data. The csv has a header row.

Each of the columns represents a metric/stat/counter being gathered.

The "events" in this case are timestamps of resource utilization/performance data.

Is splunk the right tool for this, or should I be looking elsewhere?

Thanks,
db

[lguinn2]

You can do automatic field extraction based on the CSV headers, but it is a bit gawky. Here's the documentation on Extract fields from file headers

I hope this doesn't cause more questions than it answers, but feel free to post the questions here!

[dbeez]

Is there a way to do this automatically - there are thousands of columns.

I have a header row in csv format - can't I just tell extraction to follow the header row as far as field classification goes? Each non-header row follows the same regex pattern.

The way I see it now I have to manually create each field.

Apologies on my splunk illiteracy.

[bmacias84]

Yes, Splunk can handle the data just fine, just build your extractions.