topic Parse Email Subject and populate fields in Splunk Search

Parse Email Subject and populate fields

jc_najera15 — Mon, 26 Apr 2021 23:05:55 GMT

Hi Splunkers!

Im running a very simple query to get the subject of all the emails we are getting. Something like this:

index=o365_email_data
|table Subject

Results look like this:

Subject

Ticket ID: INC3333333 - Prio: 1 - High- "Description of the Incident" - has been updated

Ticket ID: INC1111111 - Prio: 4 - Low- "Description of the Incident" - has been resolved

Ticket ID: INC2222222 - Prio: 3 - Normal - "Description of the Incident" - has been created

What I would like to accomplish is to be able to parse certain parts of that Subject and fill a table like this:

Ticket	Priority	Description	Status
INC3333333	High	Description of the Incident	updated
INC1111111	Low	Description of the Incident	resolved
INC2222222	Normal	Description of the Incident	created

This resembles a lot like the "Text to Column" function in Excel. Im completely lost on how I can achieve this.

Many thanks!

Re: Parse Email Subject and populate fields

s2_splunk — Tue, 27 Apr 2021 01:41:23 GMT

The rex command is your friend to do this in search:

Here is the run anywhere search for the sample event above:

| makeresults | eval subject="Ticket ID: INC3333333 - Prio: 1 - High- Description of the Incident - has been updated" | rex field=subject "Ticket ID:\s(?<Ticket>\w+) - Prio: \d - (?<Priority>\w+)-\s(?<Description>[\w\s]+)- has been (?<Status>\w+)" | table Ticket, Priority, Description, Status

You can also add these field extractions to your sourcetype, so the fields get parsed out automatically whenever you search.

HTH, Happy Splunking!

Re: Parse Email Subject and populate fields

jc_najera15 — Tue, 27 Apr 2021 14:36:36 GMT

I just had an AHA moment, thanks so much for showing me how to do this 🙂