Hello,
I'm trying to extract data depending of one word (fail* or success*) from a field that is not always the same :
Oct 16 15:12:47 10.1.0.12 date=2013-10-16 time=15:12:47 devname=WIN_XP device_id=324156465 log_id=0000010001 type=event subtype=system pri=alert user=toto adom= msg="user 'toto' login failed from GUI(192.185.63.33)"
The info I am looking for is always in "msg=" but not always at the same place.
I have tried different way with the command below :
| stats count(eval(msg="fail")) as Failed
Thanks,
Hey,
Thanks for your answer, we were'nt able to extract the info as we wanted. The | stats part worked fine, it listed all the fields however the | where didn't. As a workaround we found the following :
| rex "msg=\".*(?<Etat>(failed|success)).*\"" | stats count by Etat
This works great for us as we get both fields as result (failed and success)
Thanks again,
Gaetan
| rex "msg=\"(<YOURFIELD>.+?)\"" | stats count(YOURFIELD) as Failed | where YOURFIELD="*FAIL*"