Dashboards & Visualizations

Text loggin best practice

jondotnet
New Member

Hi Folks,

I am looking for some advice on the best way to create a text log.

Currently I am testing a log that is recording temperature probes like this:

2014-01-24,12:17:17,t1,19
2014-01-24,12:17:17,t2,21
2014-01-24,12:21:35,t1,18
2014-01-24,12:21:35,t1,22
etc.......

t1 & t2 are the 2 current active temperature probes that are read by a script and written to the log file every 5 minutes form a cron job

I will be adding more sensors in the future so was wondering if I would be better logging the data like this:

2014-02-14,15:57:57,t1=19,t2=21,t3=35
2014-02-14,15:59:13,t1=20,t2=22,t3=36

Thanks.

Tags (2)
0 Karma

dshpritz
SplunkTrust
SplunkTrust

You should check out the Logging best practices page on the Splunk Dev site.

Thanks,

Dave

dshpritz
SplunkTrust
SplunkTrust

Yes, very close, but here are some other points:

  • include a timezone with your timestamp
  • wrap and values or keys with spaces in quotes (there weren't any in your example, but it's something to keep in mind)
  • you might want to include a category

Also, you most likely don't need the commas in the event.

0 Karma

jondotnet
New Member

Hi,

Already had a look at that page but still not 100% sure on what its saying.

I think the line "key1=value1, key2=value2, key3=value3 . . ." is the same as my idea I listed but not sure.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...