Splunk Search

Can you help me with the following field extraction issue?

moizmmz
Path Finder

Hi,

I have a weird problem. I have a field called 'playerUserAgent' which returns the following sample of values:
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTT%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36

Roku/DVP-8.10%20(048.10E04145A) 

Roku/DVP-8.10%20(518.10E04500A) 

Roku/DVP-8.10%20(298.10E04159A) 

Roku/DVP-8.10%20(468.10E04145A) 

Roku/DVP-8.12%20(308.12E04024A)

Roku/DVP-8.10%20(138.10E04140A) 
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTS%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36  16,471  3.344%  

Roku/DVP-8.10%20(248.10E04145A) 16,434  3.337%  

AppleCoreMedia%20/%201.0.0.12B411%20(iPhone;%20U;%20CPU%20OS%208_1%20like%20Mac%20OS%20X;%20en_us)

In each of the above field values, you will see either 'Android' or 'Roku' or 'Apple' mentioned. I'm trying to make a new field called 'deviceType' which will replace each of those lines with just — 'Android' or 'Roku' or 'Apple' or whatever else, respectively.

Any thoughts?

Also, pls note, the field 'playerUserAgent' itself has been extracted using the rex command. Here's the query:

index=uplynk slice_played | rex field=_raw "^(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?<**playerUserAgent**>\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)"  | search playerUserAgent="*"

Pls help!!

Thanks

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

TA-user-agents should help you a lot in parsing strings like that: https://splunkbase.splunk.com/app/1843/

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes... though that's beyond the scope of answers :face_with_tongue:

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Get a new manager.

0 Karma

moizmmz
Path Finder

:face_with_tongue: You guys hiring?

0 Karma

moizmmz
Path Finder

Thanks you!

0 Karma

moizmmz
Path Finder

My manager wont install it :face_with_tongue:

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @moizmmz

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...