https://community.splunk.com/t5/Splunk-Search/Group-Login-Requests-By-UA-String/m-p/345498#M160708 <P>Hi All,</P> <P>I'm new to Splunk but have been working with it over a few months now. I'm trying to distinguish unique website logins by our customers from mobile devices. At the moment I have come up with 2 searches but one does what the other doesn't and vica versa. </P> <P>Method 1 <BR /> stats count(eval(match(cs_User_Agent, "iPhone"))) as "iPhone", count(eval(match(cs_User_Agent, "iPad"))) as "iPad", count(eval(match(cs_User_Agent, "Android"))) as "Android", count(eval(match(cs_User_Agent, "Macintosh"))) as "Macintosh", count(eval(match(cs_User_Agent, "Windows"))) as "Windows", count(eval(NOT match(cs_User_Agent, "Macintosh|iPhone|iPad|Android|Windows"))) as "Other" by a_request</P> <P>This gives me the results I want but I cannot display this in a PIE chart???</P> <P>Method 2<BR /> | rex field=cs_User_Agent "(?iPhone|Android|Macintosh|Windows|iPad)" | stats count(eval(a_request)) as Logins BY Device</P> <P>This displays in a PIE chart but I cannot determine the "Other" field for all other Device login requests.</P> <P>I need assistance in one or the other. I'm a quick learner but still in early stages of understanding the syntax.</P> <P>Many thanks!</P> Tue, 29 Sep 2020 14:27:17 GMT Bassik 2020-09-29T14:27:17Z https://community.splunk.com/t5/Splunk-Search/Group-Login-Requests-By-UA-String/m-p/345498#M160708 <P>Hi All,</P> <P>I'm new to Splunk but have been working with it over a few months now. I'm trying to distinguish unique website logins by our customers from mobile devices. At the moment I have come up with 2 searches but one does what the other doesn't and vica versa. </P> <P>Method 1 <BR /> stats count(eval(match(cs_User_Agent, "iPhone"))) as "iPhone", count(eval(match(cs_User_Agent, "iPad"))) as "iPad", count(eval(match(cs_User_Agent, "Android"))) as "Android", count(eval(match(cs_User_Agent, "Macintosh"))) as "Macintosh", count(eval(match(cs_User_Agent, "Windows"))) as "Windows", count(eval(NOT match(cs_User_Agent, "Macintosh|iPhone|iPad|Android|Windows"))) as "Other" by a_request</P> <P>This gives me the results I want but I cannot display this in a PIE chart???</P> <P>Method 2<BR /> | rex field=cs_User_Agent "(?iPhone|Android|Macintosh|Windows|iPad)" | stats count(eval(a_request)) as Logins BY Device</P> <P>This displays in a PIE chart but I cannot determine the "Other" field for all other Device login requests.</P> <P>I need assistance in one or the other. I'm a quick learner but still in early stages of understanding the syntax.</P> <P>Many thanks!</P> Tue, 29 Sep 2020 14:27:17 GMT https://community.splunk.com/t5/Splunk-Search/Group-Login-Requests-By-UA-String/m-p/345498#M160708 Bassik 2020-09-29T14:27:17Z https://community.splunk.com/t5/Splunk-Search/Group-Login-Requests-By-UA-String/m-p/345499#M160709 <P>Well i figured it out... just needed a | transpose on method 2</P> Wed, 14 Jun 2017 04:53:57 GMT https://community.splunk.com/t5/Splunk-Search/Group-Login-Requests-By-UA-String/m-p/345499#M160709 Bassik 2017-06-14T04:53:57Z