New to field extractions but hoping this is an easy one that i just can't figure out for myself. I have a syslog server sending raw logs and want to extract a new field that consists of all the data (string) between and so that i can use it in a search. So for example, if i had a raw log that said:
Jan 18 10:58:38 10.0.254.51 <134>Jan 18 10:58:38 from="[email protected]" to="[email protected]" RE: [EXTERNAL] Files for Review#012 #012
I want to extract a field called "subject" that would consist of only "RE: [EXTERNAL] Files for Review". Of course as messages flow through, the subject will change among them, but that's the just of it. It is already identifying a From and To field so my end result I am trying to create will be a table that will consist of:
"From" "To" "Subject"
I tried rex field=_raw "\" : "<(?.*)>" but it did not like that.
Any help is greatly appreciated!
