I need to extract field call "subject" from data field "FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147"

[karu0711]

Data field  "FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147" from this I need to extract  "DEMO XXX CCC"

output subject field "DEMO XXX CCC"

[Gr0und_Z3r0]

@karu0711 

| makeresults
| eval a="FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147"
| eval subject=mvindex(split(mvindex(split(a,":"),2),"|"),0)

[ITWhisperer]

Based on other answers you have been given to similar questions, what have you tried so far?

[karu0711]

I need to create separate so I can count and create dropdown to search.
  DEMO XXX CCC

[ITWhisperer]

OK So, from what you have been shown with rex already, how do you think this could be applied to your current request. Note that regex.com is a good site for creating and testing regex extractions (although they can need a bit of tweaking to use in Splunk, especially if back-slashes are involved).