Splunk Search

Recommended kv extract syntax

Path Finder

What would be the recommended syntax for writing kv pairs in our logs to easily get extracted by splunk. (performance wise and robustness)

key1="String value", key2="Another, string, value", key3=123

I want it to support string value (so they can contain the delimiter character), quoted or not, but i want it to be able to contain the delimiter sequence. And i want to support numbers.

I am still free to choose the format so please give me recommendations.

Tags (1)
0 Karma
1 Solution


State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!