New to REX field. How would I go about extracting this data?

[msage]

I'm trying to track Ringcentral data that we have in Splunk now and the objective is to sort and alert us to missed calls. However the data isn't organized the way I'm used to. This is. a snippet of the event. What I want to do is utilize the rex field to sort by result. These are some of the different results we have.  If you need any information please let me know

"result" : "Missed"
"result" : "Accepted"

"result" : "Call Connected

"duration":39,"type":"Voice","direction":"Inbound","action":"Phone Call","result":"Missed"

[richgalloway]

That format is fairly straightforward to parse with rex as long as the field order is constant.

| rex "duration\\\":(?<duration>\d+),\\\"type\\\":\\\"(?<type>[^\\\"]+)\\\",\\\"direction\\\":\\\"(?<direction>[^\\\"]+)\\\",\\\"action\\\":\\\"(?<action>[^\\\"]+)\\\",\\\"result\\\":\\\"(?<result>[^\\\"]+)"

The "extra" backslashes are there to escape the embedded quotation marks.