topic Re: Finding difficulty in extracting count of browser type from user agent in Splunk Search

Finding difficulty in extracting count of browser type from user agent

jaibalaraman — Thu, 28 Jan 2021 02:52:35 GMT

I need help in determining the browser that appear in our logs. I believe the simple way to use the app TA - UA parser or an external script but unfortunately i do not have enough access rights to use the tools.

SPL command -

index=aws sourcetype = * Website="*" | stats count(eval(match(User_Agent, "Firefox"))) as "Firefox", count(eval(match(User_Agent, "Chrome"))) as "Chrome", count(eval(match(User_Agent, "Safari"))) as "Safari", count(eval(match(User_Agent, "MSIE"))) as "IE", count(eval(match(User_Agent, "Trident"))) as "Trident", count(eval(NOT match(User_Agent, "Chrome|Firefox|Safari|MSIE|Trident"))) as "Other" | transpose | sort by User_Agent

I tried the above command, it gives all data to "Other". Firefox=0, Chrome=0 IE=0

Re: Finding difficulty in extracting count of browser type from user agent

jaibalaraman — Thu, 28 Jan 2021 02:53:29 GMT

Please find below image

Re: Finding difficulty in extracting count of browser type from user agent

manjunathmeti — Thu, 28 Jan 2021 03:50:48 GMT

hi, @jaibalaraman,
Regex applied in the match function is case sensitive, try this,

index=aws sourcetype = * Website="*" | stats count(eval(match(User_Agent, "(?i)Firefox"))) as "Firefox", count(eval(match(User_Agent, "(?i)Chrome"))) as "Chrome", count(eval(match(User_Agent, "(?i)Safari"))) as "Safari", count(eval(match(User_Agent, "(?i)MSIE"))) as "IE", count(eval(match(User_Agent, "(?i)Trident"))) as "Trident", count(eval(NOT match(User_Agent, "(?i)Chrome|Firefox|Safari|MSIE|Trident"))) as "Other" | transpose

If this reply helps you, an upvote/like would be appreciated.

Re: Finding difficulty in extracting count of browser type from user agent

jaibalaraman — Thu, 28 Jan 2021 03:53:32 GMT

Yes, i tried the SPL command and still same issue

Re: Finding difficulty in extracting count of browser type from user agent

manjunathmeti — Thu, 28 Jan 2021 03:54:53 GMT

Can you post some sample data?

Re: Finding difficulty in extracting count of browser type from user agent

jaibalaraman — Thu, 28 Jan 2021 20:38:30 GMT

Hi,

Sure

Re: Finding difficulty in extracting count of browser type from user agent

manjunathmeti — Fri, 29 Jan 2021 04:02:50 GMT

I mean sample raw data.

Re: Finding difficulty in extracting count of browser type from user agent

jaibalaraman — Mon, 01 Feb 2021 22:00:35 GMT

I am happy to share but unfortunately i don't have access to the log file.

Sorry

Thanks

Re: Finding difficulty in extracting count of browser type from user agent

jaibalaraman — Mon, 01 Feb 2021 23:19:53 GMT

Hi Splunk team

Please find below image for sample log file

Re: Finding difficulty in extracting count of browser type from user agent

jaibalaraman — Tue, 09 Feb 2021 03:30:06 GMT

Hi Team

Can any one help me on this please ??

Re: Finding difficulty in extracting count of browser type from user agent

scelikok — Tue, 09 Feb 2021 04:11:28 GMT

Hi @jaibalaraman,

Your problem seems that User_Agent field is not exist as it is or there is no event returns from search before stats command.

1. Run below search to see any results?

index=aws sourcetype = * Website="*"

If there is no results, please check if Website and User_Agent fields are correct in Interesting Fields section. You can try again using correct field names. Please keep in mind that the field names are case sensitive.

2. If above returns results, try below;

index=aws sourcetype = * Website="*" User_Agent=*

I think there will be no results, please check if User_Agent field is correct in Interesting Fields section. You can try again using correct field name. Please keep in mind that the field names are case sensitive.