Hi @ramuzzini How about this for a different approach? | eval json_data = "{" . replace(_raw, "(?<=,|^)([^=]+)=([^,]+)", "\"\\1\":\"\\2\"") . "}"
| spath input=json_data
| table Loc, Comp, User...
See more...
Hi @ramuzzini How about this for a different approach? | eval json_data = "{" . replace(_raw, "(?<=,|^)([^=]+)=([^,]+)", "\"\\1\":\"\\2\"") . "}"
| spath input=json_data
| table Loc, Comp, User, Date Here is a full working example: | makeresults count=3
| streamstats count
| eval _raw=case(count=1, "Loc=Warehouse, Comp=WH-SOC01, User=username1, Date=2025-03-18",
count=2, "Loc=Warehouse, Comp=WH-SOC02, User=username2, Date=2025-03-20",
count=3, "Loc=Warehouse, Comp=WH-SOC03, User=username1, Date=2025-03-24")
| fields _raw
| eval json_data = "{" . replace(_raw, "(?<=,|^)([^=]+)=([^,]+)", "\"\\1\":\"\\2\"") . "}"
| spath input=json_data
| table Loc, Comp, User, Date Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will