sourcetype=f5:silverline:asm irule=* vs_ip=* 
| rex "(?<log>.*)" 
| eval log_stripped = replace(log, "\\\\","") 
| rex field=log_stripped "data=\"(?<data_section>.*?)\", irule=" 
| spath input=data_section