All Apps and Add-ons

Splunk Add-on for Blue Coat ProxySG: How to handle failed extraction of http_user_agent where a user agent value is not included?

billebel
Explorer

Having an issue with the field extractions on this one. Hopefully I can explain and someone can help.

There seems to be a problem with the extraction of the http_user_agent extraction. The regex provided in the add-on is expecting the user agent to be enclosed in quotes

\s+\"(?<http_user_agent>[^\"]+)\"\s+  

but our logs have instances where a user agent is not present and only a dash is included, causing the field extraction to fail for these events.

1 Solution

billebel
Explorer

OK this seems to extract both cases.

alt text

View solution in original post

billebel
Explorer

OK this seems to extract both cases.

alt text

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

thanks, filed a bug for this thread

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Version 3.4.0 doesn't have this issue, what version was being used?

0 Karma

billebel
Explorer

Here is a sample of the two different events.

Without user agent
2015-09-16 14:35:34 1 10.1.1.1 - - - PROXIED "Financial Services" - 0 - GET - http host.domain.com 8080 /accelerated_pac_base.pac - pac - 10.1.1.1 0 109 - "none" "none" - 10.1.1.2 - - - -

With user agent
2015-09-16 14:27:56 2 1.1.1.1 someuser - content_filter_denied DENIED "Black_List_Social_Networking;Client_Facebook;Social Networking;Content Servers" 403 TCP_DENIED GET - https s-static.ak.facebook.com 443 js "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.89 Safari/537.36" 10.54.74.201 4815 467 - none - - none *.ak.fbcdn.net "Social Networking" 23.60.114.110 ?version=41 ?version=41 ?version=41 player.performgroup.com

0 Karma

rphillips_splun
Splunk Employee
Splunk Employee

in this example is "someuser" the http_user_agent you are looking to extract?

0 Karma

billebel
Explorer

No, the with user agent example works fine, but in the example below the hyphen between pac and 10.1.1.1, which is the user agent, doesn't extract.

2015-09-16 14:35:34 1 10.1.1.1 - - - PROXIED "Financial Services" - 0 - GET - http host.domain.com 8080 /accelerated_pac_base.pac - pac - 10.1.1.1 0 109 - "none" "none" - 10.1.1.2 - - - -

0 Karma

rphillips_splun
Splunk Employee
Splunk Employee

can you provide an example of a log event that includes a user agent and one that does not.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!