Splunk Search

Multiple fields in a string search

nanomatical
New Member

Hey Guys,

This is my search:

index=nexus RNA-IVS "login failed" | timechart count

which gives
time 8pm
count 63

I need to search for two strings so that i get :
time 8pm
count(login failed): 63
count(login passed) 23

Please assist 😞

Regards

Tags (1)
0 Karma

FritzWittwer
Contributor

Try

index=nexus RNA-IVS |  rex field=_raw ".*login (?<logstate>\s+).*" | timechart count by logstate

you probably have to adjust the regular expression

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...