Good evening,
How to extract couple of subject email keywords from specific field "message_subject"
Let's consider the below three dump subject emails that the user receive/send:
CEO urgent email for the invitation
CEO need the request urgently
secret national project
I want to have count not for the whole subject email but only to visualize the number of "secret" and "urgent" without the full subject email and count per hour
My query
index=mail-pri sourcetype="MSExchange*" sender=* OR recipient=*
| search message_subject IN ("*secret*","*urgent*")
| search NOT sender IN ("noreply@xyz.com","info@xyz.com")
| timechart span=1h count by Message_subject
The number of count I get (For example) Which is three counts
CEO urgent email for the invitation
CEO need the request urgently
secret national project
What I want to achieve is to get count like.
Urgent 2
Secret 1
for your kind support and thanks
Try this.
index=mail-pri sourcetype="MSExchange*" sender=* OR recipient=* (message_subject="*secret*" OR message_subject="*urgent*")
| search NOT sender IN ("noreply@xyz.com","info@xyz.com")
| eval type=case(match(message_subject, "secret"), "secret", match(message_subject, "urgent"), "urgent", 1==1, "other")
| timechart span=1h count by type
Try this.
index=mail-pri sourcetype="MSExchange*" sender=* OR recipient=* (message_subject="*secret*" OR message_subject="*urgent*")
| search NOT sender IN ("noreply@xyz.com","info@xyz.com")
| eval type=case(match(message_subject, "secret"), "secret", match(message_subject, "urgent"), "urgent", 1==1, "other")
| timechart span=1h count by type
Just Perfect, It worked as it should. Thanks for your prompt support
Thanks again,