Splunk Search

Conditional Search

mursidehsani
Explorer

Hello,

I have this search for tabular format.

 

index="webbff" "SUCCESS: REQUEST"
| table _time verificationId code BROWSER BROWSER_VERSION OS OS_VERSION  USER_AGENT status
| rename verificationId as "Verification ID", code as "HRC"
| sort -_time

 

The issue is at BROWSER column where even when user access our app via Edge it still shows as Chrome. I found a dissimilarity between the two logs. One that is accessed via Edge contains "Edg" in the logs.

Edge logs

 

metadata={BROWSER=Chrome, LOCALE=, OS=Windows, USER_AGENT=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/xxx.xx (KHTML, like Gecko) Chrome/124.0.0.0 Safari/xxx.xx Edg/124.0.0.0, BROWSER_VERSION=124, LONGITUDE=, OS_VERSION=10, IP_ADDRESS=, APP_VERSION=, LATITUDE=})

 

Chrome logs

 

metadata={BROWSER=Chrome, LOCALE=, OS=Mac OS X, USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/xxx.xx (KHTML, like Gecko) Chrome/124.0.0.0 Safari/xxx.xx, BROWSER_VERSION=124, LONGITUDE=, OS_VERSION=10, IP_ADDRESS=, APP_VERSION=, LATITUDE=})

 

My question is, how do i create a conditional search for BROWSER like if contains Edg then Edge else BROWSER?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Without knowing a bit more about your data and extracted fields, you could do something like this

 

| eval BROWSER=if(BROWSER="Chrome" AND match(_raw, " Edg\/"), "Edge", BROWSER)

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Without knowing a bit more about your data and extracted fields, you could do something like this

 

| eval BROWSER=if(BROWSER="Chrome" AND match(_raw, " Edg\/"), "Edge", BROWSER)

 

mursidehsani
Explorer

Hello @bowesmana 

Your solution hit the spot! Thank you so much 🙂

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...