Splunk Search

Extracting fields doesn't extract the same information

jhilton90
Path Finder

I'm sorting through web traffic and I'm trying to extract what device users are using from the user agent. However, when I have highlighted the device and check the preview, it has highlighted some different devices like Windows, Macintosh, Linux. 

But it has also highlighted a lot of random strings of text that definitely aren't devices, and when I've looked through these, I can clearly see the device in that user agent that hasn't been highlighted.

Is there a way to make sure devices are being highlighted to be extracted and now random strings of text etc?

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

are you using custom field extractions or the ones from a TA from Splunkbase?

If custom one, I hint to use the one for your technology from Splunkbase.

If instead you're using a TA from Splunkbase, the only way is to check one by one all the the regex extractions in the TA, but I cannot help you without the indication of what's the tecnology you're using and some sample of your logs.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...