Hi,
For the specific VSA you used in the example (h323-incoming-conf-id), (1) is the correct encoding, since Cisco VSA vendor type 1 (also more commonly referred to as cisco AV Pair) is always encoded in strings with the format of "attribute=value". This applies to other cisco VSAs that use string encoding as well. For VSA's that don't use string encoding, eg., fax-pages (vendor type 5, encoding integer), it typically doesn't include the value. You should be able to check that against the vendor dictionary to confirm. Please also see:
http://www.cisco.com/en/US/docs/ios/voice/cdr/developer/guide/cdrdefs.html
Thanks,
Wen