This seems like it should be such a straightforward thing, but having a hard time nailing down an answer we're happy with. Working on an in-house developed system, trying to update its logging into something which can be easily parsed into fields by Splunk. Logs will be picked up by light forwarded and sent along to indexing server.
Problem is just exactly how to format the data being written to the logs by the app. Ideal world would be key1=value1,key2=value2,key3=value3 (as per this ) so we can use autokv ... but there's the possibility that value could contain commas. So ... maybe we quote it? (key1="value1") But there's the possibility that values could contain quotes ... so let's backslash-escape the quotes. Nope, Splunk doesn't pay attention to the escaped quotes. Maybe we can URL-encode the data, and URL-decode at index time? Found this, and the bit in the comments sounds exactly like what we want ... except it doesn't seem to work.
So ... how to format arbitrary key-value pairs in logs to best be parsed by Splunk, when the value can contain pretty much any text character?
