fetch one field value from json

[rkishoreqa]

I need to fetch the 'sid' value from the below JSON.  

For that I prepared the below query, but it is not working. 

|rex field=_raw "sid\":\"(?P<sid>.[^\"\,\"]*)"
|stats count by sid

{

"sig_date": "11-SEP-2020 ",

"exe_date": "",

"sent_date": "13-JAN-2020",

"appr_date": "06-AUG-2020",

"comp_date": "08-SEP-2020",

"sid": "0ac00001789",

"visit": "Yes"

}

Can anyone please validate this query.

[ITWhisperer · Accepted solution]

Amongst other things, you were missing a space. but it can be simplified to

rex "sid\":\s\"(?P<sid>[^\"]*)"