https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619501#M215309 <P>Say I wanted to rename MFA challenge issued to something like "MFA issued". What that just be something like:</P><LI-CODE lang="markup">|regex _raw="MFA challenge issued" rename AS "MFA Issued" |stats count</LI-CODE> Thu, 03 Nov 2022 16:40:36 GMT jhilton90 2022-11-03T16:40:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619495#M215306 <P>We have MFA logs being sent to one of our indexes and the field I'm looking at is as follows:</P> <P>&nbsp;</P> <LI-CODE lang="markup">message: MFA challenge issued for account 1234556. Email is example@example.com</LI-CODE> <P>&nbsp;</P> <P>I want to be able to count the number of times "MFA challenge issued" occurs in the logs. I'm trying to use the rex command but it's just so confusing at the moment</P> <P>Any help would be great!</P> Thu, 03 Nov 2022 16:35:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619495#M215306 jhilton90 2022-11-03T16:35:46Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619497#M215308 <LI-CODE lang="markup">| regex _raw="MFA challenge issued" | stats count</LI-CODE> Thu, 03 Nov 2022 16:34:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619497#M215308 ITWhisperer 2022-11-03T16:34:21Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619501#M215309 <P>Say I wanted to rename MFA challenge issued to something like "MFA issued". What that just be something like:</P><LI-CODE lang="markup">|regex _raw="MFA challenge issued" rename AS "MFA Issued" |stats count</LI-CODE> Thu, 03 Nov 2022 16:40:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619501#M215309 jhilton90 2022-11-03T16:40:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619506#M215311 <P>No. all regex is doing is filtering the events with match the condition, so if your condition changes to "MFA Issued" you would do this</P><LI-CODE lang="markup">| regex _raw="MFA Issued" | stats count</LI-CODE> Thu, 03 Nov 2022 16:46:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619506#M215311 ITWhisperer 2022-11-03T16:46:07Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619507#M215312 <P>It's okay, I realized there's not point to it. Thanks for your help</P> Thu, 03 Nov 2022 16:47:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-certain-string-of-text-from-an-interesting/m-p/619507#M215312 jhilton90 2022-11-03T16:47:41Z