Security

Web browser analytics for web site

rickwylie
New Member

I am trying to do some analytics out of the apache log file for the breakdown on types of browsers accessing the site. I have found the following script and a reference to the "documentation" which says "click here for the latest version" which goes nowhere.

https://github.com/JustinAzoff/splunk-scripts/blob/master/ua2os.py

Anyway I'm using Splunk 6.1.2 and wnat to know :
a. Is this type of script still valid from trying to generate dashboards and information as identified above
b. Is there any documentation that discusses how to do this for Splunk 6.x

or

c. Preferably a step by step guide on how to get such a script working?

Thanks in advance.

Tags (3)
0 Karma

rickwylie
New Member

Hi There thanks for the responses. Yes, All my data is coming in from my forwarders and being indexed. (OSX Server running apache2.

See sample below.

mgovlab.codinet.ae 192.168.59.26 - - [24/Jul/2014:07:23:03 +0400] "GET /getApplicationList.php?sinceTimeStamp=1405523236 HTTP/1.1" 200 31 "-" "python-requests/2.2.1 CPython/2.7.5 Darwin/13.1.0"

I'll try the app and see how we go.

Thanks.

0 Karma

lguinn2
Legend

Here is what you need to do:

  1. Get the apache logs into Splunk. As @strive mentioned, indexing the data is the first step. The apache "combined format" works well with Splunk and should have the sourcetype=access_combined.

  2. Download the free Splunk technology add-in/app TA-uas_parser. This app understands how to parse the user agent string to extract detailed info about the browser that connected.

Forget the script.

0 Karma

rickwylie
New Member

Hi There thanks for the responses. Yes, All my data is coming in from my forwarders and being indexed. (OSX Server running apache2.

See sample below.

mgovlab.codinet.ae 192.168.59.26 - - [24/Jul/2014:07:23:03 +0400] "GET /getApplicationList.php?sinceTimeStamp=1405523236 HTTP/1.1" 200 31 "-" "python-requests/2.2.1 CPython/2.7.5 Darwin/13.1.0"

I'll try the app and see how we go.

Thanks.

0 Karma

strive
Influencer

Have you completed forwarder and indexer configurations and indexed your logs? Can you post some sample log events from your log file.

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...