How to extract field as time in ms after occurrence of a string

[ashvini_mishra]

Here is a log example - 

{"log_time":"2021-08-27T07:16:46.178275260+00:00","output":"stdout","log":"2021-08-27 07:16:46.178 [INFO ] [her-49] a.a.ActorSystemImpl - Logged Request:HttpMethod(POST):http://id-test.api-gateway.sit.ls.api.com/repos/hrn:idmrepo-sit::ol:idm_team_internal_test/ids/getOrCreate/bulk?streaming=true&dscid=GvaIrM-cb4005f6-a828-4fd7-9f54-6082e2912716:200 OK:4","k8scluster":"borg-dev-1-aws-west-1","namespace":"*","env":"DEV","app_time":"","time":"1630048606.178275260"}

I need to extract the digits after "OK:" (here highlighted in red color) as time in ms. 
I am just started using splunk. I am trying this - 

rex "([^\:]+$)(?P<duration>.+)" | stats exactperc98(duration) as P98 avg(duration) as AVG by log

But this is not working.

[bowesmana]

Given that you appear to have a field name 'log' already, which is the data from your JSON example, then if that's the field you need to extract duration from, then 

| rex field=log "OK:(?<duration>\d+)"

Note that if the encapsulated log didn't result in a 200 OK response, then of course this will not work

[PickleRick]

It's always best if you have the whole event parsed so you don't accidentaly hit some unexpected string occurrence in other part of the event. But anyway, it should be quite simple

| rex "OK:(?<duration>\d+)\"" | <<your stats>>