How to extract json fields from json inside single quotes?

[Alanshiau717]

Hey I am having difficulties trying to extract fields from my splint logs. They are in the format of

’{“field”: “value1”, “field2”: “value2”}’  I’ve tried using spath but it doesn’t seem to work. I think the issue is that the json object is enclosed in single quotes so splunk doesn’t recognise it as json. 

[yuanliu]

One solution is to rex the json out.  Assuming that the sample data you give is _raw:

| rex "'(?<jfield>[^']+)"
| spath input=jfield