Splunk Search

Grouping similar fields using search syntax?

the_wolverine
Champion

I have a ton of useragent type fields, like MacOutlook/some_version_x_os_version_etc and Entourage/other_version_x_os_version_etc. How can I group these for reporting so they all show up as MacOutlook and Entourage?

1 Solution

sideview
SplunkTrust
SplunkTrust

1) It's a pretty manual technique, but you can do it with eval, if and searchmatch.

For example, this string of evals will create a field called userAgentType whose values are just Entourage, MacOutlook and Other.

<your search>  
| eval userAgentType=if(searchmatch("useragent=*Entourage*"), "Entourage",userAgentType)
| eval userAgentType=if(searchmatch("useragent=*MacOutlook*"), "MacOutlook",userAgentType)
| eval userAgentType=if(isnull(userAgentType),"Other", userAgentType)

and to tack a chart on the end:

<your search>  
| eval userAgentType=if(searchmatch("useragent=*Entourage*"), "Entourage",userAgentType)
| eval userAgentType=if(searchmatch("useragent=*MacOutlook*"), "MacOutlook",userAgentType)
| eval userAgentType=if(isnull(userAgentType),"Other", userAgentType) 
| timechart count by userAgentType

2) Another way you could do it, is to create a bunch of eventtypes that match based on userAgent, and then just do searches with by eventtype on the end. In that scenario though you'd have to be careful not to have overlapping eventtypes, as well as to somehow filter out all of the eventtypes that have nothing to do with 'useragent-ness'

View solution in original post

sideview
SplunkTrust
SplunkTrust

1) It's a pretty manual technique, but you can do it with eval, if and searchmatch.

For example, this string of evals will create a field called userAgentType whose values are just Entourage, MacOutlook and Other.

<your search>  
| eval userAgentType=if(searchmatch("useragent=*Entourage*"), "Entourage",userAgentType)
| eval userAgentType=if(searchmatch("useragent=*MacOutlook*"), "MacOutlook",userAgentType)
| eval userAgentType=if(isnull(userAgentType),"Other", userAgentType)

and to tack a chart on the end:

<your search>  
| eval userAgentType=if(searchmatch("useragent=*Entourage*"), "Entourage",userAgentType)
| eval userAgentType=if(searchmatch("useragent=*MacOutlook*"), "MacOutlook",userAgentType)
| eval userAgentType=if(isnull(userAgentType),"Other", userAgentType) 
| timechart count by userAgentType

2) Another way you could do it, is to create a bunch of eventtypes that match based on userAgent, and then just do searches with by eventtype on the end. In that scenario though you'd have to be careful not to have overlapping eventtypes, as well as to somehow filter out all of the eventtypes that have nothing to do with 'useragent-ness'

David
Splunk Employee
Splunk Employee

You can always use a rex to pull out a subset of the field. For example, if you just want to pull the contents of the useragent field before the /, you could do the following:

YourSearch | rex field=useragent "^(?<GeneralAgent>.*?)/" | stats count by GeneralAgent

If you don't have the useragent already pulled out, you could expand that:

YourSearch | rex field=_raw "UserAgent=(?<GeneralAgent>.*?)/" | stats count by GeneralAgent

You can then move that extraction into your props.conf to make it permanent.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...