topic Log format for Splunk key=value in Splunk Search

Log format for Splunk key=value

splunkreal — Mon, 26 Jul 2021 14:38:35 GMT

Hello guys,

do you advice this log format:

key=value instead of key="value" ? Thanks.

Re: Log format for Splunk key=value

kamlesh_vaghela — Mon, 26 Jul 2021 14:38:52 GMT

Yes @splunkreal

key="value" will more suggested than key=value.

If you go with key=value and in case the value has SPACE then Splunk field auto discovery will consider only first word of that value. In this case you have to write your own field extraction.

Here, I suggest you to create a sample file and index it with sample data (with double quotes and without double quotes) you will get it what is the best way to store value.

🙂

Re: Log format for Splunk key=value

richgalloway — Mon, 26 Jul 2021 14:40:21 GMT

It depends. K=V is simpler to parse, but if the value contains spaces or commas then it must be quoted. If you must choose one or the other then go with K="V".