We have MFA logs being sent to one of our indexes and the field I'm looking at is as follows:
message: MFA challenge issued for account 1234556. Email is example@example.com
I want to be able to count the number of times "MFA challenge issued" occurs in the logs. I'm trying to use the rex command but it's just so confusing at the moment
Any help would be great!
Say I wanted to rename MFA challenge issued to something like "MFA issued". What that just be something like:
|regex _raw="MFA challenge issued" rename AS "MFA Issued"
|stats count
No. all regex is doing is filtering the events with match the condition, so if your condition changes to "MFA Issued" you would do this
| regex _raw="MFA Issued"
| stats count
It's okay, I realized there's not point to it. Thanks for your help
| regex _raw="MFA challenge issued"
| stats count