Splunk Search

Data extraction for msexchange subject field?

priya1926
Path Finder

Hi Team,

 

I need a rex command to extract subject field from the event _raw.. Currently i am splitting the fields with comma(,) and extracting the fields based on Index number.
The above scenario is success for 80 % of data but it fails to extract for rest because
 subject contains comma within the subject itself which is causing the subject to split into two different fields.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share some sample events.

---
If this reply helps you, Karma would be appreciated.

priya1926
Path Finder

examples of subject

 "RE:This is about subject, field"

 RE,This is about subject field 1

[internal] "RE:This is about subject field"

 "RE:This is about subject field 1,2,3

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This doesn't look like a raw event (just the subject field?) - please share the full raw event in a code block </>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some anonymised events in a code block </> to preserve formatting.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...