Splunk Search

Multiple fields in a string search

New Member

Hey Guys,

This is my search:

index=nexus RNA-IVS "login failed" | timechart count

which gives
time 8pm
count 63

I need to search for two strings so that i get :
time 8pm
count(login failed): 63
count(login passed) 23

Please assist 😞


Tags (1)
0 Karma



index=nexus RNA-IVS |  rex field=_raw ".*login (?<logstate>\s+).*" | timechart count by logstate

you probably have to adjust the regular expression

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...