topic Re: How does splunk split field contents in dictionary format? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-does-splunk-split-field-contents-in-dictionary-format/m-p/625998#M217590 <P>Your log looks pretty standard and fields can be parsed into name/value pairs with the extract command. Then, your info field looks a bit like JSON only you have single quotes instead of double quotes. Your can switch these with the replace function, Then you can parse the (now correct) JSON field with the spath command</P><LI-CODE lang="markup">| extract | eval info=replace(info,"'","\"") | spath input=info</LI-CODE> Thu, 05 Jan 2023 13:05:43 GMT ITWhisperer 2023-01-05T13:05:43Z How does splunk split field contents in dictionary format? https://community.splunk.com/t5/Splunk-Search/How-does-splunk-split-field-contents-in-dictionary-format/m-p/625997#M217589 <P>current splunk log:</P><PRE>user=a,ip=b,info={'gender':1,'Country':2},p=1,</PRE><P>target splunk table:</P><PRE>&nbsp;user=a,ip=b,gender=1,Country=2,p=1,</PRE><P>&nbsp;</P> Thu, 05 Jan 2023 12:58:02 GMT https://community.splunk.com/t5/Splunk-Search/How-does-splunk-split-field-contents-in-dictionary-format/m-p/625997#M217589 Cathy 2023-01-05T12:58:02Z Re: How does splunk split field contents in dictionary format? https://community.splunk.com/t5/Splunk-Search/How-does-splunk-split-field-contents-in-dictionary-format/m-p/625998#M217590 <P>Your log looks pretty standard and fields can be parsed into name/value pairs with the extract command. Then, your info field looks a bit like JSON only you have single quotes instead of double quotes. Your can switch these with the replace function, Then you can parse the (now correct) JSON field with the spath command</P><LI-CODE lang="markup">| extract | eval info=replace(info,"'","\"") | spath input=info</LI-CODE> Thu, 05 Jan 2023 13:05:43 GMT https://community.splunk.com/t5/Splunk-Search/How-does-splunk-split-field-contents-in-dictionary-format/m-p/625998#M217590 ITWhisperer 2023-01-05T13:05:43Z Re: How does splunk split field contents in dictionary format? https://community.splunk.com/t5/Splunk-Search/How-does-splunk-split-field-contents-in-dictionary-format/m-p/626021#M217592 Thank you for your answer. It works! Thu, 05 Jan 2023 15:37:52 GMT https://community.splunk.com/t5/Splunk-Search/How-does-splunk-split-field-contents-in-dictionary-format/m-p/626021#M217592 Cathy 2023-01-05T15:37:52Z