https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-logging-format-for-key-value-when-one-value-is/m-p/327475#M60807 <P>I would say <CODE>KV_MODE=auto</CODE> should be fine. You can create field extraction for JSON data using <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX">Interactive Field Extractor</A> using regular expression.</P> Wed, 11 Apr 2018 20:09:55 GMT niketn 2018-04-11T20:09:55Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-logging-format-for-key-value-when-one-value-is/m-p/327474#M60806 <P>Hello -- I am logging incoming HTTP requests to my logs, what would be the best format for Splunk to pick them up in if one of the values has JSON? Example:</P> <PRE><CODE>user=jsmith method=POST path=/a/path payload="{some: "thing"}" </CODE></PRE> <P>or</P> <PRE><CODE>user=jsmith method=POST path=/a/path payload={some: "thing"} </CODE></PRE> <P>or some other way? Thanks.</P> Wed, 11 Apr 2018 15:51:28 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-logging-format-for-key-value-when-one-value-is/m-p/327474#M60806 hf2015 2018-04-11T15:51:28Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-logging-format-for-key-value-when-one-value-is/m-p/327475#M60807 <P>I would say <CODE>KV_MODE=auto</CODE> should be fine. You can create field extraction for JSON data using <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX">Interactive Field Extractor</A> using regular expression.</P> Wed, 11 Apr 2018 20:09:55 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-logging-format-for-key-value-when-one-value-is/m-p/327475#M60807 niketn 2018-04-11T20:09:55Z