unexpected close tag with regex

[puneetgupz]

I want to extract error code from the below text but getting unexpected closing tag. The name of the column in the Database is SERVICE_RESPONSE

Text:

Service execution forgetGCPPauseAndResumeCall Failed. Error -> Status Code - > 404, Status Text -> Not Found, Response Body ->{"message":"HTTP 404 Not Found","code":"not found","status":404,"contextId":"c496bcae-115b-456c-a557-3d5e2daae0b8","details":[],"errors":[]}. Check Business audit for more details

Solution1:

| rex field=SERVICE_RESPONSE "\"status\"\s*:\s*(?P<ERROR_CODE>\d+)"
//above expression is giving unexpected close tag

Solution2: 
| rex field=SERVICE_RESPONSE "&lt;dqt&gt;status&lt;dqt&gt;\:(?P<ERROR_CODE>.\w+)"

[richgalloway]

The regex used in the rex command goes through multiple layers of parsing so it needs multiple escape characters for embedded quotation marks.

Solution 1:

| rex field=SERVICE_RESPONSE "\\\"status\\\"\s*:\s*(?P<ERROR_CODE>\d+)"

 Solution 2 won't work because regular expressions don't honor URL encoding.

[PickleRick]

I suspect the HTML entities were due to some copy-pasting magic, not as part of the regexes themselves.

As for the regex - I don't understand what @puneetgupz means by "unexpected close tag"

When unescaped, the regex works perfectly well in regex101 - https://regex101.com/r/mR5JiJ/1

(you don't need to escape the quotes in regex; just in a string in Splunk).

EDIT: OK. Escaping is needed but in another place

| rex field=SERVICE_RESPONSE "\"status\"\\s*:\\s*(?P<ERROR_CODE>\\d+)"

[puneetgupz]

Still getting the same error