{ \\\"person\\\":{\\\"name\\\":{\\\"firstName\\\":\\\"John\\\",\\\"lastName\\\":\\\"Doe\\\"},\\\"address\\\":{\\\"street\\\":\\\"100 Main Ave\\\",\\\"city\\\":\\\"Redwood City\\\",\\\"usState\\\":\\\"CA\\\",\\\"zipCode\\\":\\\"94061\\\",\\\"country\\\":\\\"United States\\\",\\\"phones\\\":[],\\\"emails\\\":[],\\\"addressLines\\\":[]},\\\"addresses\\\":[],\\\"phones\\\":[{\\\"phoneType\\\":\\\"Home\\\",\\\"phoneNumber\\\":\\\"6500000000\\\"}],\\\"email\\\":\\\"johndoe@gmail.com\\\",\\\"dateOfBirth\\\":\\\"1900/01/01\\\",\\\"nationalId\\\":\\\"100\\\",\\\"gender\\\":\\\"Male\\\"},\\\"credential\\\":{\\\"userName\\\":\\\"johndoe@gmail.com\\\",\\\"password\\\":\\\"Password\\\",\\\"securityQuestion\\\":\\\"Name of First Car?\\\",\\\"securityAnswer\\\":\\\"Volvo\\\"}\"" }         I need help in getting email in splunk search query for above json which has blackslash in logs.  I have grabbed the nametag from very big log json using spath and i am calling that tag as "nametagforthisjson"  to simplify. I tried this :    | rex field=nametagforthisjson max_match=0 "\"email:\\\\\\\":\\\\\\\"(?<email>.*)\"(?=,)" | table email   I see email label printed but not value . So my regex is wrong. the email value johndoe@gmail.com is for email name tag . So the value is until semicolon (,) . I am putting 7 blackslash.(2 backslash for 1 \  and 1 for ") regex  query version https://regex101.com/r/8BevNW/1   ... View more