Conditional Search

[mursidehsani]

Hello,

I have this search for tabular format.

index="webbff" "SUCCESS: REQUEST"
| table _time verificationId code BROWSER BROWSER_VERSION OS OS_VERSION  USER_AGENT status
| rename verificationId as "Verification ID", code as "HRC"
| sort -_time

The issue is at BROWSER column where even when user access our app via Edge it still shows as Chrome. I found a dissimilarity between the two logs. One that is accessed via Edge contains "Edg" in the logs.

Edge logs

metadata={BROWSER=Chrome, LOCALE=, OS=Windows, USER_AGENT=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/xxx.xx (KHTML, like Gecko) Chrome/124.0.0.0 Safari/xxx.xx Edg/124.0.0.0, BROWSER_VERSION=124, LONGITUDE=, OS_VERSION=10, IP_ADDRESS=, APP_VERSION=, LATITUDE=})

Chrome logs

metadata={BROWSER=Chrome, LOCALE=, OS=Mac OS X, USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/xxx.xx (KHTML, like Gecko) Chrome/124.0.0.0 Safari/xxx.xx, BROWSER_VERSION=124, LONGITUDE=, OS_VERSION=10, IP_ADDRESS=, APP_VERSION=, LATITUDE=})

My question is, how do i create a conditional search for BROWSER like if contains Edg then Edge else BROWSER?

[bowesmana · Accepted solution]

Without knowing a bit more about your data and extracted fields, you could do something like this

| eval BROWSER=if(BROWSER="Chrome" AND match(_raw, " Edg\/"), "Edge", BROWSER)

[mursidehsani]

Hello @bowesmana 

Your solution hit the spot! Thank you so much 🙂