Martin,
Maybe I am misunderstanding, but in simple (or well established) cases it detect a pattern and 'sometimes' just get it correct with zero configuration? In my case, I have now switched the data to be just the key value pairs "k1=v1 k2=v2" (4 keys per line), and now I can do basic searching, so I assume it must be detecting something. It did not however change the sourcetype.
I agree, about being explicit in all but none-simple cases, but I would hope ones like this would magically work 🙂
Regards.
Ron
... View more