I have a splunk query that has following text in message field – “message”:”sypher:[tokenized] build successful -xxxxy {“data”:{account_id”:”ABC123XYZ”,”activity”:{“time”:”2024-05-31T12:37:25Z}}”
account_id”:”ABC123XYZ”,”activity
I need to extract value ABC123XYZ which is between account_id”:” AND “,”activity. I tried the following query buty it’s not returning any data. I’d appreciate any help with this query

index=prod_logs app_name=”abc”
| rex field=_raw “account_id”:”(?[^”]+)”,”activity”
| where isnotnull (accid)
| table accid