Group Login Requests By UA String

[Bassik]

Hi All,

I'm new to Splunk but have been working with it over a few months now. I'm trying to distinguish unique website logins by our customers from mobile devices. At the moment I have come up with 2 searches but one does what the other doesn't and vica versa.

Method 1
stats count(eval(match(cs_User_Agent, "iPhone"))) as "iPhone", count(eval(match(cs_User_Agent, "iPad"))) as "iPad", count(eval(match(cs_User_Agent, "Android"))) as "Android", count(eval(match(cs_User_Agent, "Macintosh"))) as "Macintosh", count(eval(match(cs_User_Agent, "Windows"))) as "Windows", count(eval(NOT match(cs_User_Agent, "Macintosh|iPhone|iPad|Android|Windows"))) as "Other" by a_request

This gives me the results I want but I cannot display this in a PIE chart???

Method 2
| rex field=cs_User_Agent "(?iPhone|Android|Macintosh|Windows|iPad)" | stats count(eval(a_request)) as Logins BY Device

This displays in a PIE chart but I cannot determine the "Other" field for all other Device login requests.

I need assistance in one or the other. I'm a quick learner but still in early stages of understanding the syntax.

Many thanks!

[Bassik · Accepted solution]

Well i figured it out... just needed a | transpose on method 2