https://community.splunk.com/t5/Splunk-Search/Extracting-fields-doesn-t-extract-the-same-information/m-p/604472#M210255 <P>I'm sorting through web traffic and I'm trying to extract what device users are using from the user agent. However, when I have highlighted the device and check the preview, it has highlighted some different devices like Windows, Macintosh, Linux.&nbsp;</P><P>But it has also highlighted a lot of random strings of text that definitely aren't devices, and when I've looked through these, I can clearly see the device in that user agent that hasn't been highlighted.</P><P>Is there a way to make sure devices are being highlighted to be extracted and now random strings of text etc?</P> Tue, 05 Jul 2022 16:01:37 GMT jhilton90 2022-07-05T16:01:37Z https://community.splunk.com/t5/Splunk-Search/Extracting-fields-doesn-t-extract-the-same-information/m-p/604472#M210255 <P>I'm sorting through web traffic and I'm trying to extract what device users are using from the user agent. However, when I have highlighted the device and check the preview, it has highlighted some different devices like Windows, Macintosh, Linux.&nbsp;</P><P>But it has also highlighted a lot of random strings of text that definitely aren't devices, and when I've looked through these, I can clearly see the device in that user agent that hasn't been highlighted.</P><P>Is there a way to make sure devices are being highlighted to be extracted and now random strings of text etc?</P> Tue, 05 Jul 2022 16:01:37 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-fields-doesn-t-extract-the-same-information/m-p/604472#M210255 jhilton90 2022-07-05T16:01:37Z https://community.splunk.com/t5/Splunk-Search/Extracting-fields-doesn-t-extract-the-same-information/m-p/604474#M210256 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/247446">@jhilton90</a>,</P><P>are you using custom field extractions or the ones from a TA from Splunkbase?</P><P>If custom one, I hint to use the one for your technology from Splunkbase.</P><P>If instead you're using a TA from Splunkbase, the only way is to check one by one all the the regex extractions in the TA, but I cannot help you without the indication of what's the tecnology you're using and some sample of your logs.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 05 Jul 2022 16:09:32 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-fields-doesn-t-extract-the-same-information/m-p/604474#M210256 gcusello 2022-07-05T16:09:32Z