Getting Data In

Parse words in a search result

gnoellbn
Explorer

Hello,

I'm trying to extract data depending of one word (fail* or success*) from a field that is not always the same :

Oct 16 15:12:47 10.1.0.12 date=2013-10-16 time=15:12:47 devname=WIN_XP device_id=324156465 log_id=0000010001 type=event subtype=system pri=alert user=toto adom= msg="user 'toto' login failed from GUI(192.185.63.33)"

The info I am looking for is always in "msg=" but not always at the same place.

I have tried different way with the command below :

| stats count(eval(msg="fail")) as Failed

Thanks,

Tags (1)
0 Karma

gnoellbn
Explorer

Hey,

Thanks for your answer, we were'nt able to extract the info as we wanted. The | stats part worked fine, it listed all the fields however the | where didn't. As a workaround we found the following :

| rex "msg=\".*(?<Etat>(failed|success)).*\"" | stats count by Etat

This works great for us as we get both fields as result (failed and success)

Thanks again,
Gaetan

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee
| rex "msg=\"(<YOURFIELD>.+?)\"" | stats count(YOURFIELD) as Failed | where YOURFIELD="*FAIL*"
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...