How to extract a field with double quote?

[sandra_ginger]

I am new to splunk, I have event like below, the URL value has two double quote, when I extract the URL value, it always show empty value. Is there a way to remove outside double quotes?

2023-04-20T16:06:08.595+0000 SFDCLogType="ApexCallout" EVENT_TYPE="ApexCallout" TIMESTAMP="20230420160608.595" REQUEST_ID="TID:606896510000061f42" RUN_TIME="45" CPU_TIME="-1" URI="CALLOUT-LOG"  TYPE="OData" METHOD="GET" SUCCESS="0" TIME="35" REQUEST_SIZE="-1" RESPONSE_SIZE="0" URL=""https://XXX.test.com:443/api/service/"" TIMESTAMP_DERIVED="2023-04-20T16:06:08.595Z"

[sandra_ginger]

@richgalloway  That works, thank you!

[richgalloway · Accepted solution]

You'll have to extract it manually.  I like using rex for that.

| rex "URL=\\\"\\\"(?<URL>[^\\\"]+)"