extract string between backward slash and quote

[pinalshah341]

{\"reference_id\":\"REF1\",\"sub_reference_id\":\"sub_ref_1\"}

required output : table of reference_id, sub_reference_id

For the above search string : 

I am trying  :

rex field=_raw "reference_id\\\\":\\\\"(?P<reference_id>.P[^\"]*)"

But it is not working. can someone help with the correct rex command to extract the fields explicitely

[to4kawa]

index=_internal | head 1 | fields _raw
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"
| rename COMMENT as "this is sample"
| rex mode=sed "s/\\\//g"
| spath

try rex with sed mode and spath.

[ITWhisperer]

First two lines set up your example data - main line extracts the two values into the fields

| makeresults 
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"


| rex field=_raw "reference_id\\\\\":\\\\\"(?P<reference_id>[^\\\\\"]*)\\\\\",\\\\\"sub_reference_id\\\\\":\\\\\"(?P<sub_reference_id>[^\\\\\"]*)"

[bowesmana]

@pinalshah341 

| makeresults 
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"
| rex field=_raw "reference_id\\\\\":\\\\\"(?P<reference_id>[^\\\\\"]*)"

[pinalshah341]

The value is not a constant string. Hence, need a query that fetches the value dynamically.

[bowesmana]

@pinalshah341 

That rex statement is exactly that - extracting the dynamic reference - the REF1 is your example data showing how it works