How to extract JSON format using rex command?

[karthi2809]

How to extract JSON format using rex command, removing double quotes & semi colon?

"TranID":"a2775f5d", "TranStartTime":"2017-08-14T05:19:22.939-04:00", "TranEndTime":"2017-08-14T05:19:22.961-04:00"

When I extract

rex field=_raw "TranStartTime\S\S\S(?[^ ]+)"

2017-08-14T07:15:53.919-04:00",

Actually I need:

2017-08-14T07:15:53.919-04:00

[somesoni2]

Try like this

... | rex field=_raw "TranStartTime\"\:\"(?<TransStartTime>[^\"]+)"

[ddrillic]

@somesoni2, this worked perfectly fine, but trying to rex from the json field didn't work for us. Something like - | rex field=TranStartTime "<regular expression>"

Anything we miss here?

[somesoni2]

You're running your rex on field TranStartTime , is it already extracted/available???

[ddrillic]

right, it's available as a field.