topic Re: How can I search to show which browser and browser version users are using? in Splunk Search

How can I search to show which browser and browser version users are using?

marshaljoel83 — Fri, 22 Sep 2017 22:34:47 GMT

Hi,

I would like to extract and show the browser and version from the user-agent string, so as to segregate the different versions of the same browser is being used by the users (of our application).

Below is the Splunk query being used to extract the browser details:

index="sample_index" sourcetype="log_alias" operation="log-in" AND userAgent!="-" AND userAgent!="Apache" AND userAgent!="Load-weight" AND userAgent!="Java" AND userAgent!="Jakarta Commons-HttpClient" | stats count(eval(match(userAgent, "Firefox"))) as "Firefox", count(eval(match(userAgent, "Chrome"))) as "Chrome", count(eval(match(userAgent, "Safari") AND NOT match(userAgent, "Chrome"))) as "Safari", count(eval(match(userAgent, "MSIE|Trident"))) as "IE",  count(eval(NOT match(userAgent, "Chrome|Firefox|Safari|MSIE|Trident"))) as "Other"

This query will result in showing the count of users based on the browser usage. Screenshot of the statistics is shown below:

I would like to extract and segregate the individual browser based on its version(s).
For instance, if two users using two different versions of Google Chrome browser, that should be extracted.

Please suggest.

Thanks.

Re: How can I search to show which browser and browser version users are using?

lfedak_splunk — Mon, 25 Sep 2017 18:17:15 GMT

Hey @marshaljoel83, did you have any luck figuring this out?

Re: How can I search to show which browser and browser version users are using?

DalJeanis — Mon, 25 Sep 2017 18:25:35 GMT

Start with this base search

index="sample_index" sourcetype="log_alias" operation="log-in" AND userAgent!="-" AND userAgent!="Apache" AND userAgent!="Load-weight" AND userAgent!="Java" AND userAgent!="Jakarta Commons-HttpClient"

Attached to the above search, run each of the following and look at the interesting fields to identify and locate the name of the field that contains the version number. If it is the same for all of the below, then use that. If it is different, or if no field has the information, then you will have to build a composite field, perhaps using coalesce() or case()

| search match(userAgent, "Firefox") | head 5

| search match(userAgent, "Chrome") | head 5

| search match(userAgent, "Safari") | head 5

| search match(userAgent, "MSIE|Trident") | head 5