How to extract Fields custom JSON File in Splunk

[ashish9433]

I have custom JSON File on Splunk but SPATH command is not able to extract the fields from the data. Can any one suggest me what would be the best way to extract fields from the below JSON Data

{"log":"| loglevel=\"INFO\" | hostname=\"import-1-4-3-2053088235-873gq\" | transactionId=\"a0991eed-46bd-49df-9545-87deae988b6c\" | serviceName=\"import\" | version=\"1.4.3\" | thread=\"https-jsse-nio-8443-exec-12\" | logger=\"c.a.e.s.l.d.s.impl.ScheduleServiceImpl \" | message=\"Get Schedule BOC\" | status=\"GET_SCHEDULE_BOC\" | code=\"00139\" | uri=\"https://layer-1-0-2.schedule-schedule/scheduleLayer/search?version=1\u0026envContext=PROD\u0026routeOffer=BLUE\" | request=\"{\"details.type\":\"signalpath\",\"details.boc\":\"0306\"}\" \n","stream":"stdout","time":"2017-05-13T16:50:41.377682354Z"}

In Splunk the data appears formatted in JSON, but not all the fields appear as JSON formatted and thus i feel SPATH command is not working. I am able to extract the above content in a field named as Log, but the internal fields which are separated by "|". The below is the screenshot how the data appears in Splunk. Can anyone help me in extracting the fields automatically?

[koshyk · Accepted solution]

So on your already extracted spath (the screenshot output)

.. | rex field=log "(\w+)=([^\s]+)"

This will split the rest of fields present within log to key-value pairs
Example in regex101: https://regex101.com/r/4Y0aJG/1