https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364560#M107561 <P>You're running your rex on field TranStartTime , is it already extracted/available???</P> Fri, 12 Apr 2019 14:44:33 GMT somesoni2 2019-04-12T14:44:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364557#M107558 <P>How to extract JSON format using rex command, removing double quotes &amp; semi colon?</P> <P>"TranID":"a2775f5d", "TranStartTime":"2017-08-14T05:19:22.939-04:00", "TranEndTime":"2017-08-14T05:19:22.961-04:00"</P> <P>When I extract </P> <P>rex field=_raw "TranStartTime\S\S\S(?[^ ]+)"</P> <P>2017-08-14T07:15:53.919-04:00", </P> <P>Actually I need:</P> <P>2017-08-14T07:15:53.919-04:00</P> Mon, 14 Aug 2017 09:47:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364557#M107558 karthi2809 2017-08-14T09:47:01Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364558#M107559 <P>Try like this</P> <PRE><CODE>... | rex field=_raw "TranStartTime\"\:\"(?&lt;TransStartTime&gt;[^\"]+)" </CODE></PRE> Mon, 14 Aug 2017 14:26:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364558#M107559 somesoni2 2017-08-14T14:26:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364559#M107560 <P>@somesoni2, this worked perfectly fine, but trying to <CODE>rex</CODE> from the json field didn't work for us. Something like - <CODE>| rex field=TranStartTime "&lt;regular expression&gt;"</CODE></P> <P>Anything we miss here?</P> Fri, 12 Apr 2019 14:28:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364559#M107560 ddrillic 2019-04-12T14:28:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364560#M107561 <P>You're running your rex on field TranStartTime , is it already extracted/available???</P> Fri, 12 Apr 2019 14:44:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364560#M107561 somesoni2 2019-04-12T14:44:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364561#M107562 <P>right, it's available as a field.</P> Fri, 12 Apr 2019 14:48:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-JSON-format-using-rex-command/m-p/364561#M107562 ddrillic 2019-04-12T14:48:59Z