Logging Format: Should time be in its own KVP?

[daniel333]

Were writing a small app and ensuring all logs are KVP and using CIM terminology. However, I just realized I was leaving time as the start of each line and writing a props.conf for it, which is fine I suppose.

BUT seems to me time should be in its own KVP. Will doing this cause issues at all? Better practice? Here is an example in bash (we're working in Java however)

logger "_time=\"`date`\" myapp=app etc etc "

[somesoni2 · Accepted solution]

Having a KVP around the timestamp would not cause any issues. One suggestion I would make is to have the field name for timestamp something other than _time. It will not cause any issues but _time is reserved field name and it will force Splunk to rename the field as "time" (with string value of the timestamp). Just to avoid this unnecessary name conversion, I would change _time to timestamp OR simply time OR date.