Log format for Splunk key=value

[splunkreal]

Hello guys,

do you advice this log format:

key=value instead of key="value" ? Thanks.

[richgalloway · Accepted solution]

It depends.  K=V is simpler to parse, but if the value contains spaces or commas then it must be quoted.  If you must choose one or the other then go with K="V".

[kamlesh_vaghela]

Yes @splunkreal 

key="value" will more suggested than  key=value. 

If you go with key=value and in case the value has SPACE then Splunk field auto discovery will consider only first word of that value. In this case you have to write your own field extraction.

Here, I suggest you to create a sample file and index it with sample data (with double quotes and without double quotes) you will get it what is the best way to store value.

🙂

KV