topic Re: How to extract one field from the data listed? in Splunk Search

How to extract one field from the data listed?

chrisschum — Mon, 06 Aug 2018 18:00:12 GMT

How would I go about performing a field extraction when the data is structured as follows:

->Message.[some random number]: "[The Subject Line of an Email]"

All of the message numbers would be different and all of the Subject Lines would be different but the structure shown above is always the same. I've tried using the Splunk Regular Expression tool but it doesn't seem to pickup this structure.

Thanks!

Re: How to extract one field from the data listed?

amiftah — Mon, 06 Aug 2018 18:08:01 GMT

Try this: Message.\[(?<number>[^\[]+)]:\s*\"\[(?<subject>[^\[]+)]

Re: How to extract one field from the data listed?

chrisschum — Mon, 06 Aug 2018 18:31:15 GMT

Thanks for the quick response. I probably should have clarified that I just need one field extraction for all of the data listed. I also should have mentioned that the 'Subject Line' could be any alpha numeric characters separated by the quotes. Example; "Alert - Your Login Information"

Thanks!

Re: How to extract one field from the data listed?

chrisschum — Mon, 06 Aug 2018 18:38:46 GMT

I also may be putting in in the search incorrectly which may be why it isn't extracting with the search you provided. Thanks!

Re: How to extract one field from the data listed?

amiftah — Mon, 06 Aug 2018 18:50:21 GMT

Actually my regex extracts 2 fields, number and subject, to execute it from the search bar type this index=yourIndex | rex field=_raw "Message.\[(?<number>[^\[]+)]:\s*\"\[(?<subject>[^\[]+)]" If you want to extract other values, can you provide more examples (like 3 events and highlight what you want to extract). Thanks

Re: How to extract one field from the data listed?

chrisschum — Mon, 06 Aug 2018 19:09:11 GMT

Okay, I think that got it. Thanks!