Field Extraction Between Keywords Help

[ghostdog920]

New to field extractions but hoping this is an easy one that i just can't figure out for myself. I have a syslog server sending raw logs and want to extract a new field that consists of all the data (string) between and so that i can use it in a search. So for example, if i had a raw log that said:

Jan 18 10:58:38 10.0.254.51 <134>Jan 18 10:58:38 from="[email protected]" to="[email protected]" RE: [EXTERNAL] Files for Review#012 #012

I want to extract a field called "subject" that would consist of only "RE: [EXTERNAL] Files for Review". Of course as messages flow through, the subject will change among them, but that's the just of it. It is already identifying a From and To field so my end result I am trying to create will be a table that will consist of:

"From" "To" "Subject"

I tried rex field=_raw "\" : "<(?.*)>" but it did not like that.

Any help is greatly appreciated!

[ghostdog920]

Figured it out. On the regular expression build wizard of creating a new field i just need to include additional different samples so the expression could build.