topic User agent Android 10 & IOS 14 - Difficult in extracting Field in Splunk Search

User agent Android 10 & IOS 14 - Difficult in extracting Field

advidlan — Thu, 01 Jul 2021 20:59:33 GMT

I am trying to extract field from the user agent details like ( Operating system, Software, Software version, Software type, Os version, Hardware type)

However i am finding some difficulty extracting the field . For example Operation system in Android, IOS & desktop are in the different field which highlighted below.

Android user - Mozilla/5.0 (Linux; Android 10; SAMSUNG SM-T590) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser / 12.1 Chrome/79.0.3945.136 Safari/537.36

Iphone user - Mozilla/5.0 (iPhone; CPU iPhone OS 14_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1

can someone help me how do extract field from the above user agent

Software, Software version, Hardware type, Operation System, Operating system name , Operation system version.

Thanks

View more huy dung service : thay pin iPhone 8 Plus - và dịch vụ ép kính iPhone lấy liền

Re: User agent Android 10 & IOS 14 - Difficult in extracting Field

ITWhisperer — Tue, 01 Jun 2021 05:22:00 GMT

User agent is not well defined - you could try looking at other posts on the subject, for example https://community.splunk.com/t5/Knowledge-Management/REX-command-issue-for-Multiple-user-agent/m-p/535003?search-action-id=33249106577&search-result-uid=535003

Re: User agent Android 10 & IOS 14 - Difficult in extracting Field

gcusello — Tue, 01 Jun 2021 06:00:08 GMT

Hi @advidlan,

the hints of @ITWhisperer guide you to the best approach to the problem.

This is a sample of this approach:

| rex "(Linux;|iPhone;\s+CPU\s+iPhone)\s+(?<os_versione>\w+\s+\w+)"

that you can test at https://regex101.com/r/km2EXB/1

Ciao.

Giuseppe