topic Re: User agent browser type display issue in Splunk Search

User agent browser type display issue

jaibalaraman — Fri, 07 May 2021 02:08:36 GMT

Hi team

I tried the below spl eval command

index=aws Website="*"
| stats count(eval(match(User_Agent, "Firefox"))) as "Firefox", count(eval(match(User_Agent, "Chrome"))) as "Chrome", count(eval(match(User_Agent, "Safari"))) as "Safari", count(eval(match(User_Agent, "MSIE"))) as "IE", count(eval(match(User_Agent, "Trident"))) as "Trident", count(eval(NOT match(User_Agent, "Chrome|Firefox|Safari|MSIE|Trident"))) as "Other" | transpose | sort by User_Agent

When i use this to my Splunk script, it gives all data to "Other". Firefox=0, Chrome=0 IE=0,

Thanks

Re: User agent browser type display issue

richgalloway — Tue, 11 May 2021 12:45:33 GMT

To properly help you, we'd need to see examples of the User_Agent strings you're trying to match.

Have you gone to regex101.com to confirm your regular expressions work with the data you have?

Re: User agent browser type display issue

jaibalaraman — Tue, 11 May 2021 04:25:20 GMT

yes, i tried Regex it working for individual browser like below sample ,

Device	User agent	Rex command
Iphone	Mozilla/5.0 (iPhone; CPU iPhone OS 14_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Mobile/15E148 Safari/604.1	\((?<hardware_type>\w+);\s+[^ ]+\s(?<os_family>\w+\s[^ ]+)\s+(?<os_version>\w+)\s[^ ]+\s[^ ]+\s\w+\s\w.\s(?<browser_engine>\w+)\/(?<brow_engine_version>\w+[^ ]+)\s+\(.+\)\s+(?<browser_version>\w+\/[^ ]+)\s+\w+\/\w+\s(?<browser>\w+)
Ipad	Mozilla/5.0 (iPad; CPU OS 12_4_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1	\((?<hardware_type>\w+);\s+[^ ]+\s(?<os_family>\w+)\s(?<os_version>\w+)\s[^ ]+\s[^ ]+\s\w+\s\w.\s(?<browser_engine>\w+)\/(?<brow_engine_version>\w+[^ ]+)\s\(.+\)\s+(?<browser_version>\w+\/[^ ]+)\s\w+\/\w+\s(?<browser>\w+)
Window	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edge/87.0.664.66	\((?<os_family>\w+)\s+\w+\s+(?<os_version>[^;]+)[^\)]+\)\s(?<browser_egnine>\w+)\/(?<brow_engine_version>\w+[^ ]+)\s\(.+\)\s[^ ]+\s[^ ]+\s(?<browser>\w+)\/(?<browser_version>\w+[^ ]+)
Macintosh	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.2 Safari/605.1.15"	\((?<hardware_type>\w+);\s\w+\s+(?<os_family>\w+)\s(?<os_version>\w+\s[^ ]+\s[^ ]+)\s(?<browser_enginer>\w+)\/(?<brow_engine_version>\w+[^ ]+)\s\(.+\)\s(?<browser_version>\w+\/[^ ]+)\s(?<browser>\w+)
Android / Vodoafone\	Mozilla/5.0 (Linux; Android 10; SM-A217F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.101 Mobile Safari/537.36	\(\w+;\s(?<os_family>\w+)\s(?<os_version>\w+);\s(?<device_brand_model>\w+[^ ]+)\s(?<browser_enginer>\w+)\/(?<brow_engine_version>\w+[^ ]+)\s\(.+\)\s(?<browser>\w+)\/(?<browser_version>\w+[^ ]+)\s(?<hardware_type>\w+)

Re: User agent browser type display issue

jaibalaraman — Tue, 11 May 2021 04:26:49 GMT

However, i am trying to get only the browser count from the spl query

Mozilla - 400

Chrome - 500

IE - 899

Thanks

Re: User agent browser type display issue

richgalloway — Tue, 11 May 2021 13:09:48 GMT

May I suggest the TA-user-agents app (https://splunkbase.splunk.com/app/1843/) rather than re-inventing the wheel?

Re: User agent browser type display issue

jaibalaraman — Fri, 21 May 2021 02:22:00 GMT

Sorry for the late responce

Unfortunately TA - user agent app is not support for Splunk cloud user

Also , TA Browscap app is also not supported in Splunk 8.0 version

So could you please on this..

Thanks

Re: User agent browser type display issue

richgalloway — Fri, 21 May 2021 14:31:25 GMT

This is rather challenging to do in SPL, which explains why the TAs use external commands to parse the URLs. Perhaps reviewing the TAs will give you ideas on how to accomplish your goal.