Can somebody help me with a Splunk query to format the below MESSAGE field value
as something like below
You can do like this (runanywhere search, replace line1 with your search)
| gentimes start=-1 | eval MESSAGE="ABC-STATUS-COUNT={\\\"false\\\":1,\\\"true\\\":1}\\n"
| rex field=MESSAGE mode=sed "s/\\\[\"\w]//g"