Security

How to find out user device details ?

jaibalaraman
Path Finder

Excuse my knowledge with Splunk how do track user device details 

Mobile ( Device model , OS version )

Browser ( Browser details  , version ) 

Labels (1)
0 Karma

jaibalaraman
Path Finder

Hi Richard 

Thank you so much for the detailed explanation. However its bit confusing. 

Could you please help me on this

0 Karma

Richfez
SplunkTrust
SplunkTrust

It depends and there are a LOT of options here, partly depending on what you want to do with it, mostly depending on where the "original" source of data is, if anywhere.

If there is no original source of data, I'd probably recommend using a CSV file (you can build one in Excel or Google Sheets).  If you save it as a lookup you can use that to enrich other data.  That should be outlined fairly well in the following docs (and places those docs lead - keep reading and following links!), but if you get 80% of the way through and can't figure out the rest, you'll probably want to create a new question specifically about the problem you are running into.)

https://docs.splunk.com/Documentation/Splunk/8.0.6/Knowledge/Aboutlookupsandfieldactions

Likewise, if there is a spreadsheet of it already, maybe just save that as a csv file (the right tab of it, of course) and use that as above.  Someone will need to update that every now and then.

If this data is already somewhere in a DB or app,  you might be able to pull it into Splunk directly.  If a DB, you may be able to use DB Connect.  If some other app, hunt around in Splunkbase to see if you can find an app that pulls the data in.  This has the benefit (probably) of being able to be updated regularly without needing someone to export data.

You may  be asking an *entirely* different question, though!  If you are instead asking "How do I make a pretty chart or graph of who has which device, if I have apache web logs?" (Substitute whatever log source you have!).  Then the answer gets even more complex, but also maybe easier.  Different anyway.  🙂

There, I'd suggest doing the following -

1) Take the Free Splunk Training course "Fundamentals 1".  It's self paced and takes, oh, maybe half a day to a day (going from what others tell me, your time may differ).

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

2) Then find and download the Splunk Tutorial data and follow it.

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchTutorial/WelcometotheSearchTutorial

Happy Splunking!

-Rich

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...