Hi All,
I'm new to Splunk but have been working with it over a few months now. I'm trying to distinguish unique website logins by our customers from mobile devices. At the moment I have come up with 2 searches but one does what the other doesn't and vica versa.
Method 1
stats count(eval(match(cs_User_Agent, "iPhone"))) as "iPhone", count(eval(match(cs_User_Agent, "iPad"))) as "iPad", count(eval(match(cs_User_Agent, "Android"))) as "Android", count(eval(match(cs_User_Agent, "Macintosh"))) as "Macintosh", count(eval(match(cs_User_Agent, "Windows"))) as "Windows", count(eval(NOT match(cs_User_Agent, "Macintosh|iPhone|iPad|Android|Windows"))) as "Other" by a_request
This gives me the results I want but I cannot display this in a PIE chart???
Method 2
| rex field=cs_User_Agent "(?iPhone|Android|Macintosh|Windows|iPad)" | stats count(eval(a_request)) as Logins BY Device
This displays in a PIE chart but I cannot determine the "Other" field for all other Device login requests.
I need assistance in one or the other. I'm a quick learner but still in early stages of understanding the syntax.
Many thanks!
