Data field "FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147" from this I need to extract "DEMO XXX CCC"
output subject field "DEMO XXX CCC"
| makeresults
| eval a="FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147"
| eval subject=mvindex(split(mvindex(split(a,":"),2),"|"),0)
Based on other answers you have been given to similar questions, what have you tried so far?
I need to create separate so I can count and create dropdown to search.
DEMO XXX CCC
OK So, from what you have been shown with rex already, how do you think this could be applied to your current request. Note that regex.com is a good site for creating and testing regex extractions (although they can need a bit of tweaking to use in Splunk, especially if back-slashes are involved).