How to breakdown JSON data with escape characters from events

[pkol]

Hey all,
I have recently structured and extracted some data from a REST API and stored the data in an index. Now the problem is, I have one field in this data which was extracted as its original JSON structure from the API and now it looks like this in one of my events:

threshold_values="{\"thresholdLevels\": [{\"severityValue\": 4, \"severityLabel\": \"medium\", \"severityColor\": \"#FCB64E\", \"severityColorLight\": \"#FEE6C1\", \"thresholdValue\": 0, \"dynamicParam\": 0}, {\"severityValue\": 3, \"severityLabel\": \"low\", \"severityColor\": \"#FFE98C\", \"severityColorLight\": \"#FFF4C5\", \"thresholdValue\": 5, \"dynamicParam\": 0}, {\"severityValue\": 2, \"severityLabel\": \"normal\", \"severityColor\": \"#99D18B\", \"severityColorLight\": \"#DCEFD7\", \"thresholdValue\": 19, \"dynamicParam\": 0}], \"baseSeverityColorLight\": \"#E3F0F6\", \"baseSeverityColor\": \"#AED3E5\", \"gaugeMin\": 0, \"renderBoundaryMin\": 0, \"isMaxStatic\": false, \"baseSeverityValue\": 1, \"metricField\": \"count\", \"isMinStatic\": true, \"gaugeMax\": 20.9, \"baseSeverityLabel\": \"info\", \"renderBoundaryMax\": 100}"

Now my objective is to break down this field into multiple fields of SeverityLabel and SeverityValue and extract their corresponding values. This should be done for all of my events which follow a similar structure.

Please help I am new to Splunk
Thank you.

[Sukisen1981]

try this:

|rex field=_raw "severityValue\\\+\"+\:(?<sev_val>.*?)\,+\s+\\\+\"+severityLabel\\\+\"+\:+\s+\\\+\"+(?<sev_label>.*?)\\\+" max_match=0

[Sukisen1981]

hi @pkol - Did this resolve your issue?