Parse words in a search result

[gnoellbn]

Hello,

I'm trying to extract data depending of one word (fail* or success*) from a field that is not always the same :

Oct 16 15:12:47 10.1.0.12 date=2013-10-16 time=15:12:47 devname=WIN_XP device_id=324156465 log_id=0000010001 type=event subtype=system pri=alert user=toto adom= msg="user 'toto' login failed from GUI(192.185.63.33)"

The info I am looking for is always in "msg=" but not always at the same place.

I have tried different way with the command below :

| stats count(eval(msg="fail")) as Failed

Thanks,

[gnoellbn]

Hey,

Thanks for your answer, we were'nt able to extract the info as we wanted. The | stats part worked fine, it listed all the fields however the | where didn't. As a workaround we found the following :

| rex "msg=\".*(?<Etat>(failed|success)).*\"" | stats count by Etat

This works great for us as we get both fields as result (failed and success)

Thanks again,
Gaetan

[dmaislin_splunk]

| rex "msg=\"(<YOURFIELD>.+?)\"" | stats count(YOURFIELD) as Failed | where YOURFIELD="*FAIL*"