topic Re: User agent string using lookup table in Splunk Search

User agent string using lookup table

jaibalaraman — Fri, 07 May 2021 01:55:56 GMT

Hi Team

I am trying to extract the OS details from the user agent using the below eval command, however I am not able to see new filed was created (test) after i executed the spl query

index=aws Website="*"
| eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6.1"),"Windows 7")

Any help please

Thank s

Re: User agent string using lookup table

richgalloway — Fri, 07 May 2021 12:50:49 GMT

The case function will return null if none of the expressions are true. That's why it's a good practice to include as the last expression something that will always evaluate to true (similar to the 'default' case in HLLs).

index=aws Website="*" | eval test = case(match(useragent,"Windows .. 5\.1"),"Windows XP",match(useragent,"droid"),"Android",match(useragent,"Windows NT 6\.1"),"Windows 7", 1==1, "Unknown")

If the field is set to the default value then you know none of the other cases matched and you need to re-evaluate your code.

Re: User agent string using lookup table

jaibalaraman — Tue, 11 May 2021 04:23:20 GMT

Hi richgalloway

Thanks for your message

Yes, i tried executing's the SPL command found no error however i am not getting any statistics result

Re: User agent string using lookup table

richgalloway — Tue, 11 May 2021 12:44:46 GMT

The query you ran does not have a command that generates statistics so you won't see anything in the Statistics tab. Look at the results in the Events tab or add commands to the given query. It was not meant to be complete - just to answer the question asked.