Performance can be measured in different ways, but also covers both indexing and search. You could run your tests again and use job inspector to see any exact differences, but I would first ask why would you want to remove or add the key value pair fidelity. We typically encourage people to add field names so they are easier on the eyes and the performance difference to the user is not noticeable. If you search is slow, it's still gonna be slow regardless of csv or key-value pair format.
From an indexing perspective, you would save on size with csv and there is optimized/automated field extraction iirc. You are essentially saving extra bytes through the removal of the field name in the key value pair. Many years ago, people would switch to csv to save on licensing, but you remove fidelity and searchable terms.
From a search perspective, it kinda depends. If you have terms (field names) you need to search upon, like using service or source_port as a keyword, the csv format won't be as optimized as I don't believe it exists in the same way in the tsidx file (would have to double check this). I would imagine an apples to apples comparison of a "stats count" by one of the fields would return slightly different results, potentially slightly faster in the csv format as the actual value you count and process to extract from rawdata might be faster. If you consider counting by the last field in your first example line, source_ip, I would imagine that the extraction/tracking of that field will be much longer than via the csv method as we should look for the last comma then return that field, compared to trying to regex for source_ip and returning that value. I'll reiterate, it really depends what you care about and the type of search.
... View more
