Multiple fields in a string search

[nanomatical]

Hey Guys,

This is my search:

index=nexus RNA-IVS "login failed" | timechart count

which gives
time 8pm
count 63

I need to search for two strings so that i get :
time 8pm
count(login failed): 63
count(login passed) 23

Please assist 😞

Regards

[FritzWittwer]

Try

index=nexus RNA-IVS |  rex field=_raw ".*login (?<logstate>\s+).*" | timechart count by logstate

you probably have to adjust the regular expression