I am sending data to Splunk in a format I control myself. For part of the data I am using key value pairs. I want to be able to send arbitrary data as values. The easiest way to do that would be to wrap all values in double quotes, making sure to escape any double quotes in the value itself with backslashes.
Examples:
Name1="This is some string with spaces"
Name2="This is some string with spaces \"and\" double quotes"
While wrapping everything in double quotes makes sense for strings like that it is unnecessary for numbers like the following:
Count1="123"
Count2="1.23"
My question is:
Do the double quotes around the values count towards the indexing license?
If yes, it makes sense to only enclose values in double quotes that contain default delimiter characters.
