Let's say I had used a search like:
index=mail RecipientUserDomain=user@domain.com | stats count by Subject | sort-count |
and returned results such as:
Subject
Fwd: This is a subject
Fw: This is a subject
Random Subject
Fwd: Another subject
Different Subject
Fw: Another Subject
What can I use to remove the "Fwd:" & "Fw:" from the Subject to combine the counts?
There are a few ways to do that.
... | replace "Fw*: " with "" in Subject | stats ...
... | rex field=Subject mode=sed "s/Fwd?:\s(.*)/\1/" | stats ...
... | rex field=Subject "Fwd?: (?<Subject>.*)" | stats ...
Please have a try
index=mail RecipientUserDomain=user@domain.com | rex field=Subject "(Fw(.?)\:(\s+))?(?<mysubject>.+)" | stats count by mysubject | sort -count
Example
|makeresults| eval Subject="Fwd: This is a subject||Fw: This is a subject||Random Subject||Fwd: Another Subject||Different Subject||Fw: Another Subject"| makemv delim="||" Subject | mvexpand Subject | rex field=Subject "(Fw(.?)\:(\s+))?(?<mysubject>.+)" | stats count by mysubject | sort -count