Splunk Search

How can I search for a particular string in a larger string?

moizmmz
Path Finder

I am running the following query:

index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | stats values(playerUserAgent)

And I get the following values for the newly created field playerUserAgent:

-
AppleCoreMedia%20/%201.0.0.12B411%20(iPhone;%20U;%20CPU%20OS%208_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.12H606%20(Apple%20TV;%20U;%20CPU%20OS%208_4_2%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.16A404%20(iPad;%20U;%20CPU%20OS%2012_0_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.16J602%20(Apple%20TV;%20U;%20CPU%20OS%2012_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.18A391%20(Macintosh;%20U;%20Intel%20Mac%20OS%20X%2010_14;%20en_us)
Dalvik/2.1.0%20(Linux;%20U;%20Android%208.0.0;%20SM-J337P%20Build/R16NW)%20FOX%20NOW/3.10.2
Lavf/57.83.100
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTT%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36
Mozilla/5.0%20(Linux;%20Android%207.1.2;%20AFTN%20Build/NS6255;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36
Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/70.0.3538.77%20Safari/537.36
Mozilla/5.0%20(X11;%20Linux%20armv7l)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/66.0.3359.120%20Safari/537.36%20CrKey/1.32.124602
Mozilla/5.0%20(X11;%20Linux%20armv7l)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/69.0.3497.86%20Safari/537.36%20CrKey/1.35.137090
Mozilla/5.0%20(X11;%20Linux%20i686)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/29.0.1547.57%20Safari/537.36
Mozilla/5.0%20(X11;%20Linux%20x86_64;%20rv:28.0)%20Gecko/20100101%20Firefox/28.0
Mozilla/5.0%20(iPhone;%20CPU%20iPhone%20OS%207_1%20like%20Mac%20OS%20X)%20AppleWebKit/537.51.2%20(KHTML,%20like%20Gecko)%20Version/7.0%20Mobile/11D167%20Safari/9537.53%20Witbe
Roku/DVP-8.10%20(048.10E04145A)
Roku/DVP-8.10%20(098.10E04131A)
Roku/DVP-8.10%20(288.10E04155A)
Roku/DVP-8.10%20(558.10E04145A)
Roku/DVP-8.20%20(088.20E04167A)
Roku/DVP-9.0%20(559.00E04052A)

I'm aiming to create a new field called 'devicetype' which shows the following:
Roku
iOS
Android and so on

So maybe I can use a search match or something..where if I find the word Roku in the string..I can put it under 'Roku'

Pls help!

Tags (1)
0 Karma
1 Solution

kmaron
Motivator

You could do an eval like this:

| eval devicetype = case(like(playerUserAgent, "%Roku%"), "Roku", like(playerUserAgent, "%iOS%"), "iOS", like(playerUserAgent, "%Android%"), "Android", 1=1,"Other") 

View solution in original post

0 Karma

kmaron
Motivator

You could do an eval like this:

| eval devicetype = case(like(playerUserAgent, "%Roku%"), "Roku", like(playerUserAgent, "%iOS%"), "iOS", like(playerUserAgent, "%Android%"), "Android", 1=1,"Other") 
0 Karma

moizmmz
Path Finder

What does the % inside the double quotes signify?

0 Karma

kmaron
Motivator

its a wildcard (much like you're used to using *)

0 Karma

moizmmz
Path Finder

Cool! thanks..

0 Karma

moizmmz
Path Finder

Thank you thank you thank you thank you thank you!!!!

Marry me!

0 Karma

moizmmz
Path Finder

Did EXACTLY what I wanted!

0 Karma

kmaron
Motivator

you are very welcome! :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...