Finding data in Nested JSON in Splunk to create a splunk report

[Denialsams]

I 

need help in extracting ID from nested JSON data in Splunk for including this in report. Sample data:

{"preview":false,"result":{"_raw":"{"severity":"INFO","logger":"eu.notas.fns.###.utility.LoggingUtil","thread":"qtp1951963537-1006","message":{"###RequestId":"<<>>","msgDesc":"Image id Successfully ","fileName":null,"errorDesc":null,"requestType":"API","destination":"###_SERVICES","errorCode":null,"source":"EXTERNAL_issue-in","externalRequestId":"<<>>","responseCode":null,"Id":"<<>>","service":"notas-###-issue-in-data-service","stackTrace":null}}","_time":"2021-04-28T11:47:51.318+0200","host":"notas-###-issue-in-data-service-147-qthsj","index":"###_app_prod","linecount":"1","logger":"eu.notas.fns.###.utility.LoggingUtil","message.destination":"###_SERVICES","message.errorCode":"null","message.errorDesc":"null","message.externalRequestId":"<<>>","message.fileName":"null","message.Id":"<<>>","message.###RequestId":"<<>>","message.msgDesc":"Image id Successfully ","message.requestType":"API","message.responseCode":"null","message.service":"notas-###-issue-in-data-service","message.source":"EXTERNAL_issue-in","message.stackTrace":"null","punct":"{"":"","":".....","":"-","":{"":"----","":"_____",","severity":"INFO","source":"###","sourcetype":"###-prod-log","splunk_server":"no1-psplunkidx-14","thread":"qtp1951963537-1006","unix_category":"all_hosts","unix_group":"default"}}

[bowesmana]

What part of your example data contains the ID data you want to extract. That data does not look to be a valid JSON object, i.e. _raw seems to be containing a quoted nested JSON object.

Is it that Id: "<<>>" field? If so, then the simplest way to extract that is

| rex field=_raw "\"Id\":\"(?<ID>[^\"]*)"

OR

| rex field=_raw "\"Id\":\"<<(?<ID>[^>]*)"

If you don't want the <<>> parts