https://community.splunk.com/t5/Splunk-Enterprise/raw-or-json/m-p/538985#M4895 <P>Hi Team,&nbsp;</P><P>We are using splunk enterprises.&nbsp;</P><P>We can ingest data in below&nbsp; two formats.</P><P>1. json&nbsp;</P><P>2. text like "2021-02-08 16:40:39.385 INFO [main ] com.XX.program.Sample:publishToKafka - paymentId:12344 received"</P><P>Wanted to know performance wise which one is preferred.&nbsp; &nbsp;So while doing a query against the data which one will take less time.</P><P>&nbsp;</P><P>Thanks</P><P>santos</P><P>&nbsp;</P> Mon, 08 Feb 2021 12:35:09 GMT san4net 2021-02-08T12:35:09Z https://community.splunk.com/t5/Splunk-Enterprise/raw-or-json/m-p/538985#M4895 <P>Hi Team,&nbsp;</P><P>We are using splunk enterprises.&nbsp;</P><P>We can ingest data in below&nbsp; two formats.</P><P>1. json&nbsp;</P><P>2. text like "2021-02-08 16:40:39.385 INFO [main ] com.XX.program.Sample:publishToKafka - paymentId:12344 received"</P><P>Wanted to know performance wise which one is preferred.&nbsp; &nbsp;So while doing a query against the data which one will take less time.</P><P>&nbsp;</P><P>Thanks</P><P>santos</P><P>&nbsp;</P> Mon, 08 Feb 2021 12:35:09 GMT https://community.splunk.com/t5/Splunk-Enterprise/raw-or-json/m-p/538985#M4895 san4net 2021-02-08T12:35:09Z https://community.splunk.com/t5/Splunk-Enterprise/raw-or-json/m-p/538995#M4897 <P>IMO, raw text is much easier to work with.</P> Mon, 08 Feb 2021 13:46:27 GMT https://community.splunk.com/t5/Splunk-Enterprise/raw-or-json/m-p/538995#M4897 richgalloway 2021-02-08T13:46:27Z