Keep it simple. Your initial idea is good. The values (or abbreviations) for the metadata in CSV files is clean and efficient. Splunk compresses the raw data, so some space will be saved. The fact that some variables exhibit little variety in their values might even mean a smaller than average index size. In the end, if you make it complicated, you will spend lots of your valuable time getting it set up. And you will probably have to ask Splunk to do more complicated searches, which will cost more in CPU and disk I/O. And what did you save? A few gigabytes of disk? I think it is very likely that you would not "save" when you take everything into account! Here is Splunk's advice (not all of which seems applicable in this particular case): Logging Best Practices ... View more