Can you help me with the following field extraction issue?

[moizmmz]

Hi,

I have a weird problem. I have a field called 'playerUserAgent' which returns the following sample of values:
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTT%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36

Roku/DVP-8.10%20(048.10E04145A) 

Roku/DVP-8.10%20(518.10E04500A) 

Roku/DVP-8.10%20(298.10E04159A) 

Roku/DVP-8.10%20(468.10E04145A) 

Roku/DVP-8.12%20(308.12E04024A)

Roku/DVP-8.10%20(138.10E04140A) 
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTS%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36  16,471  3.344%  

Roku/DVP-8.10%20(248.10E04145A) 16,434  3.337%  

AppleCoreMedia%20/%201.0.0.12B411%20(iPhone;%20U;%20CPU%20OS%208_1%20like%20Mac%20OS%20X;%20en_us)

In each of the above field values, you will see either 'Android' or 'Roku' or 'Apple' mentioned. I'm trying to make a new field called 'deviceType' which will replace each of those lines with just — 'Android' or 'Roku' or 'Apple' or whatever else, respectively.

Any thoughts?

Also, pls note, the field 'playerUserAgent' itself has been extracted using the rex command. Here's the query:

index=uplynk slice_played | rex field=_raw "^(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?<**playerUserAgent**>\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)"  | search playerUserAgent="*"

Pls help!!

Thanks

[martin_mueller]

TA-user-agents should help you a lot in parsing strings like that: https://splunkbase.splunk.com/app/1843/

[martin_mueller]

Yes... though that's beyond the scope of answers 😛

[martin_mueller]

Get a new manager.

[moizmmz]

😛 You guys hiring?

[moizmmz]

Thanks you!

[moizmmz]

My manager wont install it 😛

[mstjohn_splunk]

hi @moizmmz

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!