Splunk Enterprise Security

Subsearch results not matching special characters

New Member


I'm trying to match email events which may consists of alphabets, numbers and special characters and do a count of the sender. However, those subjects with special characters (i.e. @, ", :, ]) is not picked up although its matching the subsearch condition. Anyone has any idea how to go about matching all character instances? Thanks!

index="A" sourcetype="A1" 
| search 
    [| search index="A" sourcetype="A1" subjects="[xxx]*" 
    | rex field=subjects "((?:\[.*\]\s+)(?<NewEmailSubject>(?:.*)))" 
    | eval subjects=NewEmailSubject
    | eval recipient=sender 
    | table subjects, recipient] 
  | stats values(subject) as subjects count by sender    
  | table sender, subjects, count
0 Karma


can you give a sample or two of data that is failing?

0 Karma

New Member

Oh sure! Some subjects sample:
1. Email Received @hotmail
2. [Hi!] FYA: 'Free' Ticket

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!