Splunk Search

How Can I Extract Specific Email Subject Keywords?

zayedaljaberi
Engager

Good evening,

How to extract couple of subject email keywords from specific field "message_subject"

Let's consider the below three dump subject emails that the user receive/send:
CEO urgent email for the invitation
CEO need the request urgently
secret national project

I want to have count not for the whole subject email but only to visualize the number of "secret" and "urgent" without the full subject email and count per hour

My query

index=mail-pri sourcetype="MSExchange*" sender=* OR recipient=* 
| search message_subject IN ("*secret*","*urgent*")
| search NOT sender IN ("noreply@xyz.com","info@xyz.com")
| timechart span=1h count by Message_subject

The number of count I get (For example) Which is three counts
CEO urgent email for the invitation
CEO need the request urgently
secret national project

What I want to achieve is to get count like.
Urgent 2
Secret 1

for your kind support and thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this.

index=mail-pri sourcetype="MSExchange*" sender=* OR recipient=* (message_subject="*secret*" OR message_subject="*urgent*")
| search NOT sender IN ("noreply@xyz.com","info@xyz.com")
| eval type=case(match(message_subject, "secret"), "secret", match(message_subject, "urgent"), "urgent", 1==1, "other")
| timechart span=1h count by type
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this.

index=mail-pri sourcetype="MSExchange*" sender=* OR recipient=* (message_subject="*secret*" OR message_subject="*urgent*")
| search NOT sender IN ("noreply@xyz.com","info@xyz.com")
| eval type=case(match(message_subject, "secret"), "secret", match(message_subject, "urgent"), "urgent", 1==1, "other")
| timechart span=1h count by type
---
If this reply helps you, Karma would be appreciated.

zayedaljaberi
Engager

Just Perfect, It worked as it should. Thanks for your prompt support

Thanks again,

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...