Splunk is not extracting the key-value pairs to the logs, and I'm wondering if this is because there are spaces in the keys and they're in quotes, or if it is because there isn't a space after the comma?
Jul 25 11:24:31 banana-server 11:24:31,582 [b-thread-01] WARN BananaServiceWorker - Service Error: "Service Error Type"="SERVICE","Service Name"="The Banana Service","Error Code"="41","Error Message"="We are out of bananas."
After playing around with it, I've learned that it does not allow spaces, and it doesn't allow quotes either to escape the spaces, without using special commands in the search field. In order to get it to properly use the auto extract, I had to get rid of the quotes and replace the spaces with underscores. Thanks.