Splunk Search

How to edit my search to display the OS version of a device and the location?

Contributor

I have a search that will display the OS version of a device and will show me at which location this device is at, right now the search is showing that location multiple times but I do not want any duplicates. Any ideas? Sorry I am a bit rusty with my Splunk!

Here is my search:

index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)"|table osversion storeNum

Here is some data:

iPad-ip0073-165464457.346545 
User-Agent:nitro/1.0.1 (iPad; iOS 10.2; Scale/2.00);
Accept-Language:en-US;q=1;
True-Client-IP:35.222.222.21;

Basically if it see's it once per storeNum will show the os version and the storeNum then move onto the next storeNum

0 Karma
1 Solution

SplunkTrust
SplunkTrust

try this

index=nitro_prod_iPad 
| rex "iPad-ip(?<storeNum>[^-]+)" 
| rex "iOS(?<osversion>[^-]+)"
| table osversion storeNum
| dedup

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You might also be interested in

...|stats latest(osversion) latest(storeNum)

Which would show the latest value of each.

0 Karma

Legend

The table command lists all events; it does not summarize. Try this

index=nitro_prod_iPad | rex "iPad-ip(?[^-]+)" | rex "iOS(?[^-]+)" | stats count by osversion storeNum

I like stats because it both dedups the list and sorts it in a single step.

0 Karma

SplunkTrust
SplunkTrust

try this

index=nitro_prod_iPad 
| rex "iPad-ip(?<storeNum>[^-]+)" 
| rex "iOS(?<osversion>[^-]+)"
| table osversion storeNum
| dedup

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

FYI - the web interface here will delete your "tags" - the open angle brackets, fieldname and close angle brackets - unless you mark them as code before submitting your question, comment or answer.

The "code" button is the one with "101 010" on it.

Also, it doesn't work well in IE, so use Chrome when posting.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!