Splunk Search

Recommended kv extract syntax

Path Finder

What would be the recommended syntax for writing kv pairs in our logs to easily get extracted by splunk. (performance wise and robustness)

key1="String value", key2="Another, string, value", key3=123

I want it to support string value (so they can contain the delimiter character), quoted or not, but i want it to be able to contain the delimiter sequence. And i want to support numbers.

I am still free to choose the format so please give me recommendations.

Tags (1)
0 Karma
1 Solution


Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!