Splunk Search

How to extract a certain string of text from an interesting field and count the number of occurrences?

jhilton90
Path Finder

We have MFA logs being sent to one of our indexes and the field I'm looking at is as follows:

 

message: MFA challenge issued for account 1234556. Email is example@example.com

 

I want to be able to count the number of times "MFA challenge issued" occurs in the logs. I'm trying to use the rex command but it's just so confusing at the moment

Any help would be great!

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| regex _raw="MFA challenge issued"
| stats count

View solution in original post

jhilton90
Path Finder

Say I wanted to rename MFA challenge issued to something like "MFA issued". What that just be something like:

|regex _raw="MFA challenge issued" rename AS "MFA Issued"
|stats count
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No. all regex is doing is filtering the events with match the condition, so if your condition changes to "MFA Issued" you would do this

| regex _raw="MFA Issued"
| stats count
0 Karma

jhilton90
Path Finder

It's okay, I realized there's not point to it. Thanks for your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex _raw="MFA challenge issued"
| stats count
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...