How can I search for a particular string in a larger string?

[moizmmz]

I am running the following query:

index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | stats values(playerUserAgent)

And I get the following values for the newly created field playerUserAgent:

-
AppleCoreMedia%20/%201.0.0.12B411%20(iPhone;%20U;%20CPU%20OS%208_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.12H606%20(Apple%20TV;%20U;%20CPU%20OS%208_4_2%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.16A404%20(iPad;%20U;%20CPU%20OS%2012_0_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.16J602%20(Apple%20TV;%20U;%20CPU%20OS%2012_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.18A391%20(Macintosh;%20U;%20Intel%20Mac%20OS%20X%2010_14;%20en_us)
Dalvik/2.1.0%20(Linux;%20U;%20Android%208.0.0;%20SM-J337P%20Build/R16NW)%20FOX%20NOW/3.10.2
Lavf/57.83.100
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTT%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36
Mozilla/5.0%20(Linux;%20Android%207.1.2;%20AFTN%20Build/NS6255;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36
Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/70.0.3538.77%20Safari/537.36
Mozilla/5.0%20(X11;%20Linux%20armv7l)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/66.0.3359.120%20Safari/537.36%20CrKey/1.32.124602
Mozilla/5.0%20(X11;%20Linux%20armv7l)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/69.0.3497.86%20Safari/537.36%20CrKey/1.35.137090
Mozilla/5.0%20(X11;%20Linux%20i686)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/29.0.1547.57%20Safari/537.36
Mozilla/5.0%20(X11;%20Linux%20x86_64;%20rv:28.0)%20Gecko/20100101%20Firefox/28.0
Mozilla/5.0%20(iPhone;%20CPU%20iPhone%20OS%207_1%20like%20Mac%20OS%20X)%20AppleWebKit/537.51.2%20(KHTML,%20like%20Gecko)%20Version/7.0%20Mobile/11D167%20Safari/9537.53%20Witbe
Roku/DVP-8.10%20(048.10E04145A)
Roku/DVP-8.10%20(098.10E04131A)
Roku/DVP-8.10%20(288.10E04155A)
Roku/DVP-8.10%20(558.10E04145A)
Roku/DVP-8.20%20(088.20E04167A)
Roku/DVP-9.0%20(559.00E04052A)

I'm aiming to create a new field called 'devicetype' which shows the following:
Roku
iOS
Android and so on

So maybe I can use a search match or something..where if I find the word Roku in the string..I can put it under 'Roku'

Pls help!

[kmaron · Accepted solution]

You could do an eval like this:

| eval devicetype = case(like(playerUserAgent, "%Roku%"), "Roku", like(playerUserAgent, "%iOS%"), "iOS", like(playerUserAgent, "%Android%"), "Android", 1=1,"Other") 

[moizmmz]

What does the % inside the double quotes signify?

[kmaron]

its a wildcard (much like you're used to using *)

[moizmmz]

Cool! thanks..

[moizmmz]

Thank you thank you thank you thank you thank you!!!!

Marry me!

[moizmmz]

Did EXACTLY what I wanted!

[kmaron]

you are very welcome! 🙂