Best Sourcetype for KV pair

[splunkLPN]

1- How to define the KV pair and delimitation in the source type ?

the extract has this form (with 15 KV)
k1="v1", k2="v2", ...

2- What extract form do you recommend (JSON ?)

3- is
| extract pairdelim=", " kvdelim="="

as fast as define that in the source type ?

thks for your help 🙂

[sundareshr]

The difference between using extract during in your search and setting up search time extraction is with search time extraction, the fields are available for using without having to extract them every time. Also allows you to create aliases etc. With the extract command, you will have to repeat the extraction with every search.

To enable to search time extraction, you will need to make the following changes

*Transforms*

    [kv_pair_delim]
    DELIMS = ",", "="

*Props*
[your sourcetype stanza]
REPORT-activity = kv_pair_delim

[woodcock]

You need to provide more detail and better text. What exactly are you trying to do and what do your raw events look like (show a few samples)?

It looks like you are asking 2 questions. If you have raw events in the form listed in 1 above, then you should be able to use the extract that you provided in 3. As far as 2, perhaps you are asking if you should convert the source data into JSON instead of KVP. I would say Yes because KVP is only a little smaller than JSON and JSON will probably be more efficient to digest. If you have the ability to modify the source events, though, I highly recommend going to CSV with a header line, instead.