Data extraction for msexchange subject field?

[priya1926]

Hi Team,

I need a rex command to extract subject field from the event _raw.. Currently i am splitting the fields with comma(,) and extracting the fields based on Index number.
The above scenario is success for 80 % of data but it fails to extract for rest because
 subject contains comma within the subject itself which is causing the subject to split into two different fields.

[richgalloway]

Please share some sample events.

[priya1926]

examples of subject

 "RE:This is about subject, field"

 RE,This is about subject field 1

[internal] "RE:This is about subject field"

 "RE:This is about subject field 1,2,3

[ITWhisperer]

This doesn't look like a raw event (just the subject field?) - please share the full raw event in a code block </>

[ITWhisperer]

Please share some anonymised events in a code block </> to preserve formatting.