help with backslash

[curiousvivek]

{
  \\\"person\\\":{\\\"name\\\":{\\\"firstName\\\":\\\"John\\\",\\\"lastName\\\":\\\"Doe\\\"},\\\"address\\\":{\\\"street\\\":\\\"100 Main Ave\\\",\\\"city\\\":\\\"Redwood City\\\",\\\"usState\\\":\\\"CA\\\",\\\"zipCode\\\":\\\"94061\\\",\\\"country\\\":\\\"United States\\\",\\\"phones\\\":[],\\\"emails\\\":[],\\\"addressLines\\\":[]},\\\"addresses\\\":[],\\\"phones\\\":[{\\\"phoneType\\\":\\\"Home\\\",\\\"phoneNumber\\\":\\\"6500000000\\\"}],\\\"email\\\":\\\"[email protected]\\\",\\\"dateOfBirth\\\":\\\"1900/01/01\\\",\\\"nationalId\\\":\\\"100\\\",\\\"gender\\\":\\\"Male\\\"},\\\"credential\\\":{\\\"userName\\\":\\\"[email protected]\\\",\\\"password\\\":\\\"Password\\\",\\\"securityQuestion\\\":\\\"Name of First Car?\\\",\\\"securityAnswer\\\":\\\"Volvo\\\"}\""
}

I need help in getting email in splunk search query for above json which has blackslash in logs.  I have grabbed the nametag from very big log json using spath and i am calling that tag as "nametagforthisjson"  to simplify.

I tried this : 

| rex field=nametagforthisjson max_match=0 "\"email:\\\\\\\":\\\\\\\"(?<email>.*)\"(?=,)"
| table email

I see email label printed but not value . So my regex is wrong. the email value [email protected] is for email name tag . So the value is until semicolon (,) . I am putting 7 blackslash.(2 backslash for 1 \  and 1 for ")
regex  query version https://regex101.com/r/8BevNW/1

[curiousvivek]

Thanks,I did this :

| eval formattedjson = replace(nametagforthisjson,"\\\\", "")| table formattedjson

that but now i have json enclosed in double quotes

[see below]

"{
  "person": {
    "name": {
      "firstName": "John",
      "lastName": "Doe"
    },
    "address": {
      "street": "100 Main st",
      ...
      "phones": [
        
      ],
      "emails": [
        
      ],
      "addressLines": [
        
      ]
    },
    "addresses": [
      
    ],
    "phones": [
      {
        "phoneType": "Mobile",
        "phoneNumber": "65000000"
      }
    ],
    "email": "[email protected]",
   ....
      
  }
  
}"

What should I do to remove this enclosing double quotes?
Once this is success, I want to do
eval email = json_extract('formattedjson',"person.email") 

[ITWhisperer · Accepted solution]

| eval formattedjson = trim(replace(nametagforthisjson,"\\\\", ""),"\"")
| spath field=formattedjson path=person.email output=email
| table formattedjson, email

[ITWhisperer]

Have you tried replacing \\ with nothing and \" with ", then use spath to extract the field you want?