extraction help

[valpravin]

Hi Team

can you please help in extracting the  123456 from following string

hello world  \"employee\":123456

[bowesmana]

Depending on whether your escaped quotes are in your data or not...  This example includes the \ as part of the raw data string

| makeresults
| eval _raw="hello world  \\\"employee\\\":123456"
| rex field=_raw "hello world  \\\\\"employee\\\\\":(?<id>\d+)"

 So, the 5 \ characters in rex will recognise the single \ in your data