Conditional Search

mursidehsani — Tue, 23 Apr 2024 01:37:35 GMT

Hello,

I have this search for tabular format.

index="webbff" "SUCCESS: REQUEST" | table _time verificationId code BROWSER BROWSER_VERSION OS OS_VERSION USER_AGENT status | rename verificationId as "Verification ID", code as "HRC" | sort -_time

The issue is at BROWSER column where even when user access our app via Edge it still shows as Chrome. I found a dissimilarity between the two logs. One that is accessed via Edge contains "Edg" in the logs.

Edge logs

metadata={BROWSER=Chrome, LOCALE=, OS=Windows, USER_AGENT=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/xxx.xx (KHTML, like Gecko) Chrome/124.0.0.0 Safari/xxx.xx Edg/124.0.0.0, BROWSER_VERSION=124, LONGITUDE=, OS_VERSION=10, IP_ADDRESS=, APP_VERSION=, LATITUDE=})

Chrome logs

metadata={BROWSER=Chrome, LOCALE=, OS=Mac OS X, USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/xxx.xx (KHTML, like Gecko) Chrome/124.0.0.0 Safari/xxx.xx, BROWSER_VERSION=124, LONGITUDE=, OS_VERSION=10, IP_ADDRESS=, APP_VERSION=, LATITUDE=})

My question is, how do i create a conditional search for BROWSER like if contains Edg then Edge else BROWSER?

Re: Conditional Search

bowesmana — Tue, 23 Apr 2024 02:27:42 GMT

Without knowing a bit more about your data and extracted fields, you could do something like this

| eval BROWSER=if(BROWSER="Chrome" AND match(_raw, " Edg\/"), "Edge", BROWSER)

Re: Conditional Search

mursidehsani — Tue, 23 Apr 2024 02:30:49 GMT

Hello @bowesmana

Your solution hit the spot! Thank you so much 🙂

topic Conditional Search in Splunk Search

Conditional Search

Re: Conditional Search

Re: Conditional Search