How to extract one field from the data listed?

[chrisschum]

How would I go about performing a field extraction when the data is structured as follows:

->Message.[some random number]: "[The Subject Line of an Email]"

All of the message numbers would be different and all of the Subject Lines would be different but the structure shown above is always the same. I've tried using the Splunk Regular Expression tool but it doesn't seem to pickup this structure.

Thanks!

[amiftah · Accepted solution]

Try this: Message.\[(?<number>[^\[]+)]:\s*\"\[(?<subject>[^\[]+)]

[chrisschum]

Thanks for the quick response. I probably should have clarified that I just need one field extraction for all of the data listed. I also should have mentioned that the 'Subject Line' could be any alpha numeric characters separated by the quotes. Example; "Alert - Your Login Information"

Thanks!

[chrisschum]

I also may be putting in in the search incorrectly which may be why it isn't extracting with the search you provided. Thanks!

[amiftah]

Actually my regex extracts 2 fields, number and subject, to execute it from the search bar type this index=yourIndex | rex field=_raw "Message.\[(?<number>[^\[]+)]:\s*\"\[(?<subject>[^\[]+)]" If you want to extract other values, can you provide more examples (like 3 events and highlight what you want to extract). Thanks

[chrisschum]

Okay, I think that got it. Thanks!