Single row results in multiple events

[sanjaykattimani]

I have useragent string logged by our application. I am extracting OS and Browser names from these by creating event types (sample data shown below).
Now when i try to chart all OS types with the following search

eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | chart count by eventtype| sort eventtype |rename eventtype as "OperatingSystem"

I get both Browser names and Operating system names as every user agent has both browser and OS event types.

Is there anyway to get only browser names or only OS?

UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.3; .NET4.0C; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
    host=etc   Options|  sourcetype=log85   Options|  source=/app/opt/tomcat/logs/user.log   Options|  index=main   Options|  date_hour=11   Options|  date_mday=11   Options|  eventtype=Internet Explorer Browser   Options|  eventtype= Trident/IE Old Browser   Options|  eventtype=Windows OperatingSystem   Options|  eventtype=UserAgent  

[somesoni2]

Based on your example (single) event, eventtype field should be extracted as multivalue field. You can try something like this.

eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | rex max_match=0 "eventtype=(?P<Value>(\w+\s+)*)(?<Name>[^\s]+)\s+Options" | eval temp=mvzip(Name,Value,"#") | mvexpand temp | rex field=temp "(?<Name>.*)#(?<Value>.*)" | fields - temp | where Name="Browser"| chart count by Value

Change the filter 'where Name="Browser"' to "OperatingSystem' to get similar chart for Operating Systems.