How would I go about performing a field extraction when the data is structured as follows:
->Message.[some random number]: "[The Subject Line of an Email]"
All of the message numbers would be different and all of the Subject Lines would be different but the structure shown above is always the same. I've tried using the Splunk Regular Expression tool but it doesn't seem to pickup this structure.
Thanks for the quick response. I probably should have clarified that I just need one field extraction for all of the data listed. I also should have mentioned that the 'Subject Line' could be any alpha numeric characters separated by the quotes. Example; "Alert - Your Login Information"
Actually my regex extracts 2 fields, number and subject, to execute it from the search bar type this
index=yourIndex | rex field=_raw "Message.\[(?<number>[^\+)]:\s*\"\[(?<subject>[^\+)]" If you want to extract other values, can you provide more examples (like 3 events and highlight what you want to extract). Thanks