https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-a-string-search/m-p/172577#M49471 <P>Hey Guys,</P> <P>This is my search:</P> <P>index=nexus RNA-IVS "login failed" | timechart count</P> <P>which gives<BR /> time 8pm<BR /> count 63</P> <P>I need to search for two strings so that i get :<BR /> time 8pm<BR /> count(login failed): 63<BR /> count(login passed) 23</P> <P>Please assist <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>Regards</P> Thu, 13 Aug 2015 05:34:36 GMT nanomatical 2015-08-13T05:34:36Z https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-a-string-search/m-p/172577#M49471 <P>Hey Guys,</P> <P>This is my search:</P> <P>index=nexus RNA-IVS "login failed" | timechart count</P> <P>which gives<BR /> time 8pm<BR /> count 63</P> <P>I need to search for two strings so that i get :<BR /> time 8pm<BR /> count(login failed): 63<BR /> count(login passed) 23</P> <P>Please assist <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>Regards</P> Thu, 13 Aug 2015 05:34:36 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-a-string-search/m-p/172577#M49471 nanomatical 2015-08-13T05:34:36Z https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-a-string-search/m-p/172578#M49472 <P>Try </P> <PRE><CODE>index=nexus RNA-IVS | rex field=_raw ".*login (?&lt;logstate&gt;\s+).*" | timechart count by logstate </CODE></PRE> <P>you probably have to adjust the regular expression </P> Thu, 13 Aug 2015 06:12:58 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-a-string-search/m-p/172578#M49472 FritzWittwer_ol 2015-08-13T06:12:58Z