How to extract a certain string of text from an interesting field and count the number of occurrences?

[jhilton90]

We have MFA logs being sent to one of our indexes and the field I'm looking at is as follows:

message: MFA challenge issued for account 1234556. Email is example@example.com

I want to be able to count the number of times "MFA challenge issued" occurs in the logs. I'm trying to use the rex command but it's just so confusing at the moment

Any help would be great!

[jhilton90]

Say I wanted to rename MFA challenge issued to something like "MFA issued". What that just be something like:

|regex _raw="MFA challenge issued" rename AS "MFA Issued"
|stats count

[ITWhisperer]

No. all regex is doing is filtering the events with match the condition, so if your condition changes to "MFA Issued" you would do this

| regex _raw="MFA Issued"
| stats count

[jhilton90]

It's okay, I realized there's not point to it. Thanks for your help

[ITWhisperer · Accepted solution]

| regex _raw="MFA challenge issued"
| stats count