topic Re: extract subject from maillog in Splunk Search

extract subject from maillog

dictudatacom — Fri, 29 Jun 2012 09:47:05 GMT

Hi, I want to extract the 'subjects' from my SMTP maillog but the regex I have built doesn't seem to work. I have built the same type of regex to extract the FROM en TO fields and that works so I'm puzzled why it doesn't extract the subjects...

Regex looks like this:

(?i) subject <(?P[^>]*)

Can anyone help me out ? Thanks in advance!

Re: extract subject from maillog

Ayn — Fri, 29 Jun 2012 11:30:32 GMT

Please include a log sample. Without it it's hard to build a regex that should match.

Re: extract subject from maillog

jfraiberg — Fri, 29 Jun 2012 13:40:08 GMT

have you tried using the "extract fields" dropdown from one of the events?

Re: extract subject from maillog

dictudatacom — Mon, 02 Jul 2012 08:55:03 GMT

Hi Ayn, here is a sample of the logfile, I want to extract the subject:

Mon Jul 2 10:20:38 2012 Info: Start MID 62771585 ICID 33896658
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ICID 33896658 From: <*****>
Mon Jul 2 10:20:38 2012 Info: Delivery start DCID 24405838 MID 62771584 to RID [0]
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ICID 33896658 RID 0 To: <*>
Mon Jul 2 10:20:38 2012 Info: MID 62771585 Message-ID '2B2E0EB229A8F44AB8C55D5E296BCFC40C584F@SCOMP0934.wurnet.nl'
Mon Jul 2 10:20:38 2012 Info: MID 62771585 Subject 'FW: Postbus AgroFood vanaf vrijdag 17:00 VOL: opnieuw inzenden!!'
Mon Jul 2 10:20:38 2012 Info: MID 62771585 ready 19724 bytes from <****>
Mon Jul 2 10:20:38 2012 Info: MID 62771585 matched all recipients for per-recipient policy DEFAULT in the outbound table
Mon Jul 2 10:20:38 2012 Info: MID 62771585 interim AV verdict using Sophos CLEAN
Mon Jul 2 10:20:38 2012 Info: MID 62771585 antivirus negative

Re: extract subject from maillog

suepfarrell — Fri, 16 Aug 2013 03:52:31 GMT

Did you get an answer for this - trying to do this myself. My email subjects differ so I want to table them all

How did you end up extracting the subject lines?

Thanks
Sue

Re: extract subject from maillog

jstockamp — Fri, 16 Aug 2013 05:04:20 GMT

Your regex should looking something like this.

Subject.'(?.*)'

Re: extract subject from maillog

suepfarrell — Fri, 16 Aug 2013 05:54:21 GMT

Thx jstockamp - that didn't quite work. I will give more detail in my own question I think. About to go set one up now.
Thanks