Field Extraction Between Keywords Help

ghostdog920 — Fri, 18 Jan 2019 17:13:16 GMT

New to field extractions but hoping this is an easy one that i just can't figure out for myself. I have a syslog server sending raw logs and want to extract a new field that consists of all the data (string) between and so that i can use it in a search. So for example, if i had a raw log that said:

Jan 18 10:58:38 10.0.254.51 <134>Jan 18 10:58:38 from="something@something.com" to="someone@someone.com" RE: [EXTERNAL] Files for Review#012 #012

I want to extract a field called "subject" that would consist of only "RE: [EXTERNAL] Files for Review". Of course as messages flow through, the subject will change among them, but that's the just of it. It is already identifying a From and To field so my end result I am trying to create will be a table that will consist of:

"From" "To" "Subject"

I tried rex field=_raw "\" : "<(?.*)>" but it did not like that.

Any help is greatly appreciated!

Re: Field Extraction Between Keywords Help

ghostdog920 — Fri, 18 Jan 2019 17:57:07 GMT

Figured it out. On the regular expression build wizard of creating a new field i just need to include additional different samples so the expression could build.

topic Field Extraction Between Keywords Help in Splunk Dev

Field Extraction Between Keywords Help

Re: Field Extraction Between Keywords Help