Splunk Search

Group Login Requests By UA String

Bassik
Path Finder

Hi All,

I'm new to Splunk but have been working with it over a few months now. I'm trying to distinguish unique website logins by our customers from mobile devices. At the moment I have come up with 2 searches but one does what the other doesn't and vica versa.

Method 1
stats count(eval(match(cs_User_Agent, "iPhone"))) as "iPhone", count(eval(match(cs_User_Agent, "iPad"))) as "iPad", count(eval(match(cs_User_Agent, "Android"))) as "Android", count(eval(match(cs_User_Agent, "Macintosh"))) as "Macintosh", count(eval(match(cs_User_Agent, "Windows"))) as "Windows", count(eval(NOT match(cs_User_Agent, "Macintosh|iPhone|iPad|Android|Windows"))) as "Other" by a_request

This gives me the results I want but I cannot display this in a PIE chart???

Method 2
| rex field=cs_User_Agent "(?iPhone|Android|Macintosh|Windows|iPad)" | stats count(eval(a_request)) as Logins BY Device

This displays in a PIE chart but I cannot determine the "Other" field for all other Device login requests.

I need assistance in one or the other. I'm a quick learner but still in early stages of understanding the syntax.

Many thanks!

Tags (1)
0 Karma
1 Solution

Bassik
Path Finder

Well i figured it out... just needed a | transpose on method 2

View solution in original post

0 Karma

Bassik
Path Finder

Well i figured it out... just needed a | transpose on method 2

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...