Hello guys,
do you advice this log format:
key=value instead of key="value" ? Thanks.
It depends. K=V is simpler to parse, but if the value contains spaces or commas then it must be quoted. If you must choose one or the other then go with K="V".
It depends. K=V is simpler to parse, but if the value contains spaces or commas then it must be quoted. If you must choose one or the other then go with K="V".
Yes @splunkreal
key="value" will more suggested than key=value.
If you go with key=value and in case the value has SPACE then Splunk field auto discovery will consider only first word of that value. In this case you have to write your own field extraction.
Here, I suggest you to create a sample file and index it with sample data (with double quotes and without double quotes) you will get it what is the best way to store value.
🙂
KV