https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/636287#M16671 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250407">@karu0711</a>&nbsp;<BR /><BR /></P><LI-CODE lang="markup">| makeresults | eval a="FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147" | eval subject=mvindex(split(mvindex(split(a,":"),2),"|"),0)</LI-CODE><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Gr0und_Z3r0_0-1679998854603.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24576i3056B9F513DA7730/image-size/medium?v=v2&amp;px=400" role="button" title="Gr0und_Z3r0_0-1679998854603.png" alt="Gr0und_Z3r0_0-1679998854603.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P> Tue, 28 Mar 2023 10:21:00 GMT Gr0und_Z3r0 2023-03-28T10:21:00Z https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635733#M16643 <P>Data field&nbsp; "FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147" from this I need to extract&nbsp; "DEMO XXX CCC"<BR /><BR />output subject field "DEMO XXX CCC"</P> Thu, 23 Mar 2023 14:52:53 GMT https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635733#M16643 karu0711 2023-03-23T14:52:53Z https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635754#M16644 <P>Based on other answers you have been given to similar questions, what have you tried so far?</P> Thu, 23 Mar 2023 16:56:22 GMT https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635754#M16644 ITWhisperer 2023-03-23T16:56:22Z https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635757#M16645 <P>I need to create separate so I can count and create dropdown to search.<BR />&nbsp; DEMO XXX CCC</P> Thu, 23 Mar 2023 17:14:24 GMT https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635757#M16645 karu0711 2023-03-23T17:14:24Z https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635758#M16646 <P>OK So, from what you have been shown with rex already, how do you think this could be applied to your current request. Note that regex.com is a good site for creating and testing regex extractions (although they can need a bit of tweaking to use in Splunk, especially if back-slashes are involved).</P> Thu, 23 Mar 2023 17:18:42 GMT https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/635758#M16646 ITWhisperer 2023-03-23T17:18:42Z https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/636287#M16671 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250407">@karu0711</a>&nbsp;<BR /><BR /></P><LI-CODE lang="markup">| makeresults | eval a="FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147" | eval subject=mvindex(split(mvindex(split(a,":"),2),"|"),0)</LI-CODE><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Gr0und_Z3r0_0-1679998854603.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24576i3056B9F513DA7730/image-size/medium?v=v2&amp;px=400" role="button" title="Gr0und_Z3r0_0-1679998854603.png" alt="Gr0und_Z3r0_0-1679998854603.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P> Tue, 28 Mar 2023 10:21:00 GMT https://community.splunk.com/t5/Security/I-need-to-extract-field-call-quot-subject-quot-from-data-field/m-p/636287#M16671 Gr0und_Z3r0 2023-03-28T10:21:00Z