Support for LogEntries KVP format?

[RamG]

Splunk would not automatically extract fields from my application log files that have Key-Value Pairs (KVP) delimited with TAB characters.  https://docs.rapid7.com/insightops/json-kvp-parsing

Would Custom Parsing need to be configured on the Splunk Forwarder side?

or is there some other efficient way to get automatic field extraction of KVP data?

Thanks

Ram

Thanks for sharing any document

[richgalloway]

Splunk will parse key=value events automatically as well as many other formats.  If it doesn't parse your data automatically then, yes, you will need custom parsing.

Custom parsing is performed on indexers or heavy forwarders - not on universal forwarders (usually).

Why are you referencing a Rapid7 document about parsing on Splunk?