Hi,
I'm trying to match email events which may consists of alphabets, numbers and special characters and do a count of the sender. However, those subjects with special characters (i.e. @, ", :, ]) is not picked up although its matching the subsearch condition. Anyone has any idea how to go about matching all character instances? Thanks!
index="A" sourcetype="A1"
| search
[| search index="A" sourcetype="A1" subjects="[xxx]*"
| rex field=subjects "((?:\[.*\]\s+)(?<NewEmailSubject>(?:.*)))"
| eval subjects=NewEmailSubject
| eval recipient=sender
| table subjects, recipient]
| stats values(subject) as subjects count by sender
| table sender, subjects, count
