Splunk Search

How to extract a certain string of text from an interesting field and count the number of occurrences?

jhilton90
Path Finder

We have MFA logs being sent to one of our indexes and the field I'm looking at is as follows:

 

message: MFA challenge issued for account 1234556. Email is example@example.com

 

I want to be able to count the number of times "MFA challenge issued" occurs in the logs. I'm trying to use the rex command but it's just so confusing at the moment

Any help would be great!

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| regex _raw="MFA challenge issued"
| stats count

View solution in original post

jhilton90
Path Finder

Say I wanted to rename MFA challenge issued to something like "MFA issued". What that just be something like:

|regex _raw="MFA challenge issued" rename AS "MFA Issued"
|stats count
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No. all regex is doing is filtering the events with match the condition, so if your condition changes to "MFA Issued" you would do this

| regex _raw="MFA Issued"
| stats count
0 Karma

jhilton90
Path Finder

It's okay, I realized there's not point to it. Thanks for your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex _raw="MFA challenge issued"
| stats count
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...