which format is efficient for splunk indexing : XML or JSON

nsiva23 — Fri, 11 Apr 2014 05:33:09 GMT

Which is best format to index for the splunk indexer XML or JSON... what is recommendation from SPlunk like which format is efficient.

Thanks

Re: which format is efficient for splunk indexing : XML or JSON

somesoni2 — Fri, 11 Apr 2014 13:07:39 GMT

Splunk recommended log format is key-value paired, but to decide between JSON or XML, JSON should be a better selection.

See section 'Use developer-friendly formats' in the below link.