Archive

Group Login Requests By UA String

Path Finder

Hi All,

I'm new to Splunk but have been working with it over a few months now. I'm trying to distinguish unique website logins by our customers from mobile devices. At the moment I have come up with 2 searches but one does what the other doesn't and vica versa.

Method 1
stats count(eval(match(csUserAgent, "iPhone"))) as "iPhone", count(eval(match(csUserAgent, "iPad"))) as "iPad", count(eval(match(csUserAgent, "Android"))) as "Android", count(eval(match(csUserAgent, "Macintosh"))) as "Macintosh", count(eval(match(csUserAgent, "Windows"))) as "Windows", count(eval(NOT match(csUserAgent, "Macintosh|iPhone|iPad|Android|Windows"))) as "Other" by a_request

This gives me the results I want but I cannot display this in a PIE chart???

Method 2
| rex field=csUserAgent "(?iPhone|Android|Macintosh|Windows|iPad)" | stats count(eval(a_request)) as Logins BY Device

This displays in a PIE chart but I cannot determine the "Other" field for all other Device login requests.

I need assistance in one or the other. I'm a quick learner but still in early stages of understanding the syntax.

Many thanks!

Tags (1)
0 Karma
1 Solution

Path Finder

Well i figured it out... just needed a | transpose on method 2

View solution in original post

0 Karma

Path Finder

Well i figured it out... just needed a | transpose on method 2

View solution in original post

0 Karma