> encapsulated as JSON structs, adds so much complexity to the process Or XML, you need to have written a parser (or pay Splunk to do it for you), you have to

> encapsulated as JSON structs, adds so much complexity to the process Or XML, you need to have written a parser (or pay Splunk to do it for you), you have to know how deeply nested your param of interest is. AFAIU Splunk has problems with too-deeply nested JSON, it was written at the time of unstructured logs. I can say this with confidence, for most of my problem cases, a good start to finding the culprit was a good tail -f and grep. I doubt myself and frequently ask if I'm one of those idiots who'd rather have faster horses. I mean, those are brilliant people making money hand over fist with their log analytics and event management tools, they know what they're doing, right? Right?