Splunk Search

Multiple fields in a string search

nanomatical
New Member

Hey Guys,

This is my search:

index=nexus RNA-IVS "login failed" | timechart count

which gives
time 8pm
count 63

I need to search for two strings so that i get :
time 8pm
count(login failed): 63
count(login passed) 23

Please assist 😞

Regards

Tags (1)
0 Karma

FritzWittwer_ol
Contributor

Try

index=nexus RNA-IVS |  rex field=_raw ".*login (?<logstate>\s+).*" | timechart count by logstate

you probably have to adjust the regular expression

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...