https://community.splunk.com/t5/Splunk-Search/Advice-on-how-to-format-custom-application-logs/m-p/136931#M37474 <P>Hi brent_weaver,</P> <P>if your development is really that nice, go for <CODE>key=value</CODE> pairs and Splunk will pick it up.</P> <P>cheers, MuS</P> <P>PS: JSON, csv or XML will also work <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 24 Jul 2015 04:15:43 GMT MuS 2015-07-24T04:15:43Z https://community.splunk.com/t5/Splunk-Search/Advice-on-how-to-format-custom-application-logs/m-p/136930#M37473 <P>What is the optimal format our application can generate for splunk to pick it up by default? Development can make the format whatever it needs to be, what is best?</P> Fri, 24 Jul 2015 02:37:28 GMT https://community.splunk.com/t5/Splunk-Search/Advice-on-how-to-format-custom-application-logs/m-p/136930#M37473 brent_weaver 2015-07-24T02:37:28Z https://community.splunk.com/t5/Splunk-Search/Advice-on-how-to-format-custom-application-logs/m-p/136931#M37474 <P>Hi brent_weaver,</P> <P>if your development is really that nice, go for <CODE>key=value</CODE> pairs and Splunk will pick it up.</P> <P>cheers, MuS</P> <P>PS: JSON, csv or XML will also work <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 24 Jul 2015 04:15:43 GMT https://community.splunk.com/t5/Splunk-Search/Advice-on-how-to-format-custom-application-logs/m-p/136931#M37474 MuS 2015-07-24T04:15:43Z https://community.splunk.com/t5/Splunk-Search/Advice-on-how-to-format-custom-application-logs/m-p/136932#M37475 <P>There's a page on logging best practices <A href="http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6">here</A> that might contain further relevant ideas.</P> Fri, 24 Jul 2015 05:55:27 GMT https://community.splunk.com/t5/Splunk-Search/Advice-on-how-to-format-custom-application-logs/m-p/136932#M37475 jeffland 2015-07-24T05:55:27Z