topic Re: Data extraction for msexchange subject field in Splunk Search

Data extraction for msexchange subject field?

priya1926 — Tue, 28 Mar 2023 14:40:08 GMT

Hi Team,

I need a rex command to extract subject field from the event _raw.. Currently i am splitting the fields with comma(,) and extracting the fields based on Index number.
The above scenario is success for 80 % of data but it fails to extract for rest because
subject contains comma within the subject itself which is causing the subject to split into two different fields.

Re: Data extraction for msexchange subject field?

ITWhisperer — Tue, 28 Mar 2023 15:55:58 GMT

Please share some anonymised events in a code block </> to preserve formatting.

Re: Data extraction for msexchange subject field?

richgalloway — Tue, 28 Mar 2023 15:56:34 GMT

Please share some sample events.

Re: Data extraction for msexchange subject field

priya1926 — Tue, 28 Mar 2023 16:16:57 GMT

examples of subject

"RE:This is about subject, field"

RE,This is about subject field 1

[internal] "RE:This is about subject field"

"RE:This is about subject field 1,2,3

Re: Data extraction for msexchange subject field

ITWhisperer — Tue, 28 Mar 2023 16:27:42 GMT

This doesn't look like a raw event (just the subject field?) - please share the full raw event in a code block </>