Text loggin best practice

[jondotnet]

Hi Folks,

I am looking for some advice on the best way to create a text log.

Currently I am testing a log that is recording temperature probes like this:

2014-01-24,12:17:17,t1,19
2014-01-24,12:17:17,t2,21
2014-01-24,12:21:35,t1,18
2014-01-24,12:21:35,t1,22
etc.......

t1 & t2 are the 2 current active temperature probes that are read by a script and written to the log file every 5 minutes form a cron job

I will be adding more sensors in the future so was wondering if I would be better logging the data like this:

2014-02-14,15:57:57,t1=19,t2=21,t3=35
2014-02-14,15:59:13,t1=20,t2=22,t3=36

Thanks.

[dshpritz]

You should check out the Logging best practices page on the Splunk Dev site.

Thanks,

Dave

[dshpritz]

Yes, very close, but here are some other points:

• include a timezone with your timestamp
• wrap and values or keys with spaces in quotes (there weren't any in your example, but it's something to keep in mind)
• you might want to include a category

Also, you most likely don't need the commas in the event.

[jondotnet]

Hi,

Already had a look at that page but still not 100% sure on what its saying.

I think the line "key1=value1, key2=value2, key3=value3 . . ." is the same as my idea I listed but not sure.