Splunk Add-on for Okta: Is the the ua2os script incorrectly mapping data as iPad data?

[dfqobvbkmnpi]

I noticed that the Okta app is categorizing non-iPad data as iPad.

I'm not fluent in Python, but it looks like the script is searching each line of raw data for matches on any of the strings listed in the mapping tables.

For example, raw data with the msClientUserAgent listed as Apple-iPhone... is showing up in a search for operating_system=iPad. I think the python script is matching on the "ipAddress" field in the raw data, since it starts with "ipad".

This seems like a huge mistake, but I can't think of any other explanation.

[jcoates_splunk]

Hi, I'm not sure what config is doing that, but I don't see anything in the Okta add-on that sets that field at all, or is named ua2os -- If you don't mind, I'll take off the add-on for Okta tag.